]> git.ipfire.org Git - thirdparty/linux.git/log
thirdparty/linux.git
5 weeks agoiio: accel: adxl372: factor out buffer and trigger setup
Antoniu Miclaus [Sat, 21 Mar 2026 10:04:58 +0000 (12:04 +0200)] 
iio: accel: adxl372: factor out buffer and trigger setup

Extract the triggered buffer, trigger allocation, and IRQ request
logic from adxl372_probe() into a dedicated adxl372_buffer_setup()
helper. This reduces the probe function complexity and prepares for
conditionally disabling buffer support on device variants with
known FIFO issues.

No functional change intended.

Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
5 weeks agodt-bindings: iio: accel: adi,adxl372: add ADXL371 compatible
Antoniu Miclaus [Sat, 21 Mar 2026 10:04:57 +0000 (12:04 +0200)] 
dt-bindings: iio: accel: adi,adxl372: add ADXL371 compatible

Add the adi,adxl371 compatible string to the ADXL372 binding. The
ADXL371 is a +-200g 3-axis MEMS accelerometer nearly identical to
the ADXL372 in register layout, differing only in ODR/bandwidth
values, timer scale factors, and a silicon anomaly affecting FIFO
operation.

Update the title and description to reflect both devices.

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
5 weeks agoiio: accel: adxl372: introduce chip_info structure
Antoniu Miclaus [Sat, 21 Mar 2026 10:04:56 +0000 (12:04 +0200)] 
iio: accel: adxl372: introduce chip_info structure

Introduce a chip_info structure to parameterize device-specific
properties such as ODR/bandwidth frequency tables, activity/inactivity
timer scale factors, and the maximum ODR value. This refactors the
driver to use chip_info lookups instead of hardcoded values, preparing
the driver to support multiple device variants.

The sampling_frequency and filter_low_pass_3db_frequency available
attributes are switched from custom sysfs callbacks to read_avail()
based handling via info_mask_shared_by_type_available. This enforces
consistent formatting through the IIO framework and makes the values
accessible to in-kernel consumers.

The SPI/I2C probe functions are updated to pass a chip_info pointer
instead of a device name string.

No functional change intended.

Signed-off-by: Antoniu Miclaus <antoniu.miclaus@analog.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
5 weeks agoMerge tag 'v7.1-rockchip-dts64-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel...
Krzysztof Kozlowski [Sat, 21 Mar 2026 10:57:53 +0000 (11:57 +0100)] 
Merge tag 'v7.1-rockchip-dts64-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt

New boards: RK3576-EVB2, OneThing Edge Cube
New soc-peripherals: DisplayPort on RK3576
New overlays: TSx33 device-revisions, HD702E display/touchscreen on
NanoPC-T4

And as always a number of per-board changes for added or enabled
peripherals, added supplies, things moved to more fitting positions.

* tag 'v7.1-rockchip-dts64-1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (28 commits)
  arm64: dts: rockchip: enable vicap dvp on wolfvision pf5 io expander
  arm64: dts: rockchip: Add analog audio switches to RK3576 EVB1
  arm64: dts: rockchip: Enable GPU on rk3566-pinenote
  arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up config
  arm64: dts: rockchip: add pinctrl for clk-generator GPIO on rk3588-tiger
  arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-tiger
  arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-jaguar
  arm64: dts: rockchip: Enable displayport for rk3576 evb2
  arm64: dts: rockchip: Add battery and charger on rk3566-pinenote
  arm64: dts: rockchip: Fix sdmmc pwren pinctrl for rk3576-evb2
  arm64: dts: rockchip: Describe HDMI supplies for nanopi4 boards
  arm64: dts: rockchip: Clean up NanoPi-R2S Plus gmac2io
  arm64: dts: rockchip: add pwm-fan for NanoPC-T6
  arm64: dts: rockchip: Add rk3576 evb2 board
  dt-bindings: arm: rockchip: Add rk3576 evb2 board
  arm64: dts: rockchip: Add overlay for FriendlyElec HD702E
  arm64: dts: rockchip: Move RK3399 eDP pinctrl to boards
  arm64: dts: rockchip: add overlay for qnap-ts133 device revision
  arm64: dts: rockchip: add overlay for qnap-ts233 device revision
  arm64: dts: rockchip: add overlay for qnap-ts433 device revision
  ...

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
5 weeks agox86/um: fix vDSO installation
Thomas Weißschuh [Wed, 18 Mar 2026 21:03:26 +0000 (22:03 +0100)] 
x86/um: fix vDSO installation

The generic vDSO installation logic used by 'make vdso_install' requires
that $(vdso-install-y) is defined by the top-level architecture Makefile
and that it contains a path relative to the root of the tree.
For UML neither of these is satisfied.

Move the definition of $(vdso-install-y) to a place which is included by
the arch/um/Makefile and use the full relative path.

Fixes: f1c2bb8b9964 ("um: implement a x86_64 vDSO")
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://patch.msgid.link/20260318-um-vdso-install-v1-1-26a4ca5c4210@weissschuh.net
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: Remove CONFIG_FRAME_WARN from x86_64_defconfig
Tiwei Bie [Sun, 8 Mar 2026 06:04:06 +0000 (14:04 +0800)] 
um: Remove CONFIG_FRAME_WARN from x86_64_defconfig

The CONFIG_FRAME_WARN=1024 setting in x86_64_defconfig originates
from arch/um/defconfig, which was split into i386_defconfig and
x86_64_defconfig by commit e40f04d040c6 ("arch/um: make it work
with defconfig and x86_64"). Currently, it's even smaller than the
default on 32bit (i.e., 1280). It's no longer suitable for 64bit.
Building with x86_64_defconfig triggers the following warning:

lib/maple_tree.c: In function ‘mas_wr_bnode’:
lib/maple_tree.c:3740:1: warning: the frame size of 1056 bytes is larger than 1024 bytes [-Wframe-larger-than=]
 3740 | }
      | ^

Since we have a larger CONFIG_KERNEL_STACK_ORDER on 64bit (twice
that of 32bit) by default, we could increase CONFIG_FRAME_WARN
accordingly. Let's remove the CONFIG_FRAME_WARN=1024 setting from
x86_64_defconfig and just use the default value (2048 for 64bit)
defined in lib/Kconfig.debug, as we do for 32bit.

Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260308060406.2772832-1-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: Fix pte_read() and pte_exec() for kernel mappings
Tiwei Bie [Mon, 2 Mar 2026 23:52:24 +0000 (07:52 +0800)] 
um: Fix pte_read() and pte_exec() for kernel mappings

The pte_read() and pte_exec() helpers are only used during the TLB
sync to determine the read/exec permissions for mmap. However, for
kernel mappings, they will always return 0. This leads to kern_map()
having to unconditionally set the exec flag to 1 and the read flag
unexpectedly always being 0. Remove the unnecessary check for the
_PAGE_USER bit in these helpers to ensure that the kernel mapping
permissions can be correctly determined.

Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260302235224.1915380-3-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: Fix potential race condition in TLB sync
Tiwei Bie [Mon, 2 Mar 2026 23:52:23 +0000 (07:52 +0800)] 
um: Fix potential race condition in TLB sync

During the TLB sync, we need to traverse and modify the page table,
so we should hold the page table lock. Since full SMP support for
threads within the same process is still missing, let's disable the
split page table lock for simplicity.

Fixes: 1e4ee5135d81 ("um: Add initial SMP support")
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Link: https://patch.msgid.link/20260302235224.1915380-2-tiwei.btw@antgroup.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: time-travel: clean up kernel-doc warnings
Randy Dunlap [Thu, 26 Feb 2026 22:11:12 +0000 (14:11 -0800)] 
um: time-travel: clean up kernel-doc warnings

Repair all kernel-doc warnings in um_timetravel.h:
- add one enum description
- mark "reserve" as private
- use a leading '@' on current_time

Warning: include/uapi/linux/um_timetravel.h:59 Enum value
 'UM_TIMETRAVEL_SHARED_MAX_FDS' not described in enum
 'um_timetravel_shared_mem_fds'
Warning: include/uapi/linux/um_timetravel.h:245 union member 'reserve'
 not described in 'um_timetravel_schedshm_client'
Warning: include/uapi/linux/um_timetravel.h:288 struct member
 'current_time' not described in 'um_timetravel_schedshm'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20260226221112.1042008-1-rdunlap@infradead.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: avoid struct sigcontext redefinition with musl
Marcel W. Wysocki [Sun, 15 Feb 2026 14:28:03 +0000 (22:28 +0800)] 
um: avoid struct sigcontext redefinition with musl

mcontext.c includes both <sys/ucontext.h> and <asm/sigcontext.h>.
With musl libc, this causes a struct sigcontext redefinition error:

  <sys/ucontext.h> pulls in musl's <bits/signal.h>, which defines
  struct sigcontext directly.  The kernel's <asm/sigcontext.h> then
  provides a second, conflicting definition of the same struct.

With glibc this does not conflict because glibc's signal headers
source their struct sigcontext from the kernel's own UAPI headers,
so the include guard in <asm/sigcontext.h> makes the second
inclusion a no-op.

mcontext.c does not actually use struct sigcontext by name -- it
only needs the FP-state types (_fpstate, _xstate, etc.) that are
defined in <asm/sigcontext.h> independently of the sigcontext
struct.

Temporarily rename sigcontext to __kernel_sigcontext during the
inclusion of <asm/sigcontext.h> so that the kernel's definition
does not collide with musl's.  The #undef restores normal name
resolution immediately afterward.

No functional change with glibc; fixes the build with musl.

Signed-off-by: Marcel W. Wysocki <maci.stgn@gmail.com>
Link: https://patch.msgid.link/20260215142803.1455757-2-maci.stgn@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agoum: fix address-of CMSG_DATA() rvalue in stub
Marcel W. Wysocki [Sun, 15 Feb 2026 14:28:02 +0000 (22:28 +0800)] 
um: fix address-of CMSG_DATA() rvalue in stub

The UML stub takes the address of CMSG_DATA(fd_msg):

    fd_map = (void *)&CMSG_DATA(fd_msg);

CMSG_DATA() is specified by POSIX to return unsigned char *.  Taking
its address is semantically wrong -- the intent is to get a pointer
to the control message data, which is exactly what CMSG_DATA()
already returns.

This happens to compile with glibc because glibc's primary
CMSG_DATA definition accesses a flexible array member:

    #define CMSG_DATA(cmsg) ((cmsg)->__cmsg_data)

An array lvalue can have its address taken, and &array yields the
same address as array.  However, glibc also has an alternative
definition that uses pointer arithmetic (returning an rvalue), and
musl's definition always uses pointer arithmetic:

    /* musl */
    #define CMSG_DATA(cmsg) \
        ((unsigned char *)(((struct cmsghdr *)(cmsg)) + 1))

Taking the address of an rvalue is a hard error in C, so the
current code fails to compile with musl libc.

Remove the erroneous & operator.  The resulting code is correct
regardless of the CMSG_DATA implementation -- it simply assigns the
data pointer, which is what the subsequent code (fd_map[--num_fds])
expects.

No functional change with glibc; fixes the build with musl.

Signed-off-by: Marcel W. Wysocki <maci.stgn@gmail.com>
Link: https://patch.msgid.link/20260215142803.1455757-1-maci.stgn@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
5 weeks agodrm/i915/wm: Include .min_ddb_alloc_uv in the wm dumps
Ville Syrjälä [Thu, 19 Mar 2026 11:40:34 +0000 (13:40 +0200)] 
drm/i915/wm: Include .min_ddb_alloc_uv in the wm dumps

We include the Y/RGB .min_ddb_alloc in the wm state change dumps.
Do the same for .min_ddb_alloc_uv, on the platforms where it is
used.

Also adjust the whitespace in the other debug prints to keep
the values for each wm level lined up across all the lines.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-10-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Include ddb_y in skl_print_wm_changes() on pre-icl
Ville Syrjälä [Thu, 19 Mar 2026 11:40:33 +0000 (13:40 +0200)] 
drm/i915/wm: Include ddb_y in skl_print_wm_changes() on pre-icl

Pre-icl doesn't use a separate hardware plane for Y scanout,
and instead it's all handled magically by the hardware. We
do still need to allocate DDB space for the Y color plane
though (PLANE_NV12_BUF_CFG). Include that information in the
debugs so that we know where it ended up.

On icl+ the equivalent information is dumped as the hardware
Y plane's normal ddb allocation.

v2: Use prink field width for ddb_name alignment

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-9-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Extract skl_print_plane_ddb_changes()
Ville Syrjälä [Thu, 19 Mar 2026 11:40:32 +0000 (13:40 +0200)] 
drm/i915/wm: Extract skl_print_plane_ddb_changes()

We have skl_print_plane_wm_changes() but the DDB counterpart is
just inline in the main loop. Extract it into a function. We'll
have a second use for this soon.

The "ddb" part is already parametrized in anticipation of the
second user.

v2: Use prink field width for ddb_name alignment

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-8-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agocrypto: krb5enc - fix sleepable flag handling in encrypt dispatch
Wesley Atwell [Mon, 9 Mar 2026 06:26:24 +0000 (00:26 -0600)] 
crypto: krb5enc - fix sleepable flag handling in encrypt dispatch

krb5enc_encrypt_ahash_done() continues encryption from an ahash
completion callback by calling krb5enc_dispatch_encrypt().

That helper takes a flags argument for this continuation path, but it
ignored that argument and reused aead_request_flags(req) when setting
up the skcipher subrequest callback. This can incorrectly preserve
CRYPTO_TFM_REQ_MAY_SLEEP when the encrypt step is started from callback
context.

Preserve the original request flags but clear
CRYPTO_TFM_REQ_MAY_SLEEP for the callback continuation path, and use
the caller-supplied flags when setting up the skcipher subrequest.

Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm")
Assisted-by: Codex:GPT-5
Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
5 weeks agocrypto: simd - reject compat registrations without __ prefixes
Wesley Atwell [Mon, 9 Mar 2026 04:31:43 +0000 (22:31 -0600)] 
crypto: simd - reject compat registrations without __ prefixes

simd_register_skciphers_compat() and simd_register_aeads_compat()
derive the wrapper algorithm names by stripping the __ prefix from the
internal algorithm names.

Currently they only WARN if cra_name or cra_driver_name lacks that prefix,
but they still continue and unconditionally add 2 to both strings. That
registers wrapper algorithms with incorrectly truncated names after a
violated precondition.

Reject such inputs with -EINVAL before registering anything, while keeping
the warning so invalid internal API usage is still visible.

Fixes: d14f0a1fc488 ("crypto: simd - allow registering multiple algorithms at once")
Fixes: 1661131a0479 ("crypto: simd - support wrapping AEAD algorithms")
Assisted-by: Codex:GPT-5
Signed-off-by: Wesley Atwell <atwellwea@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
5 weeks agodrm/i915/wm: s/skl_print_plane_changes()/skl_print_plane_wm_changes()/
Ville Syrjälä [Thu, 19 Mar 2026 11:40:31 +0000 (13:40 +0200)] 
drm/i915/wm: s/skl_print_plane_changes()/skl_print_plane_wm_changes()/

Rename skl_print_plane_changes() to skl_print_plane_wm_changes()
to better reflect what it does.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-7-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Nuke wm->uv_wm[]
Ville Syrjälä [Thu, 19 Mar 2026 11:40:30 +0000 (13:40 +0200)] 
drm/i915/wm: Nuke wm->uv_wm[]

We currently keep around the full watermarks for the UV plane
on pre-icl, even though the hardware doesn't need most of this
information. The only thing we need to keep is the min_ddb_alloc
for the UV plane. Move that into the main wm->wm[].min_ddb_alloc_uv
alongside the other min_ddb_alloc (used for Y/RGB).

This makes our state tracking match the hardware more closely,
and avoids having to justify everwhere why uv_wm[] is being
ignored.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-6-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Extract skl_allocate_plane_ddb_nv12()
Ville Syrjälä [Thu, 19 Mar 2026 11:40:29 +0000 (13:40 +0200)] 
drm/i915/wm: Extract skl_allocate_plane_ddb_nv12()

Extract skl_allocate_plane_ddb_nv12() as the compute counterpart to
skl_check_wm_level_nv12(). Mainly to hide some of the clutter from
skl_crtc_allocate_plane_ddb().

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-5-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: s/skl_check_nv12_wm_level()/skl_check_wm_level_nv12()/
Ville Syrjälä [Thu, 19 Mar 2026 11:40:28 +0000 (13:40 +0200)] 
drm/i915/wm: s/skl_check_nv12_wm_level()/skl_check_wm_level_nv12()/

Rename skl_check_nv12_wm_level() to skl_check_wm_level_nv12(). There
will be a sort of DDB counterparts to skl_check_wm_level*(), and
putting the "nv12" part to the end will allow consistent naming.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-4-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Reorder the arguments to skl_allocate_plane_ddb()
Ville Syrjälä [Thu, 19 Mar 2026 11:40:27 +0000 (13:40 +0200)] 
drm/i915/wm: Reorder the arguments to skl_allocate_plane_ddb()

Group the ddb and data_rate together in the skl_allocate_plane_ddb()
arguments. Upcoming changes will adjust the UV plane handling and
keeing the ddb allocation and the data rate used to calculate it
together will help with clarity.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-3-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915/wm: Nuke is_planar from skl+ wm structures
Ville Syrjälä [Thu, 19 Mar 2026 11:40:26 +0000 (13:40 +0200)] 
drm/i915/wm: Nuke is_planar from skl+ wm structures

We don't need is_planar in either the actual watermarks or the
wm_params structure used during the wm computation. Get rid
of both.

Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260319114034.7093-2-ville.syrjala@linux.intel.com
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
5 weeks agodrm/i915: Skip redundant NV12 plane unlinking
Ville Syrjälä [Mon, 16 Mar 2026 16:39:53 +0000 (18:39 +0200)] 
drm/i915: Skip redundant NV12 plane unlinking

plane_atomic_check() will already have unlinked the
old NV12 planes by the time icl_check_nv12_planes()
gets called. Drop the redundant second unlinking.

Cc: Khaled Almahallawy <khaled.almahallawy@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260316163953.12905-4-ville.syrjala@linux.intel.com
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
5 weeks agodrm/i915: Relocate unlink_nv12_plane()
Ville Syrjälä [Mon, 16 Mar 2026 16:39:52 +0000 (18:39 +0200)] 
drm/i915: Relocate unlink_nv12_plane()

Move unlink_nv12_plane() ahead of its first caller to
avoid the forward declaration.

Cc: Khaled Almahallawy <khaled.almahallawy@intel.com>
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260316163953.12905-3-ville.syrjala@linux.intel.com
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
5 weeks agodrm/i915: Unlink NV12 planes earlier
Ville Syrjälä [Mon, 16 Mar 2026 16:39:51 +0000 (18:39 +0200)] 
drm/i915: Unlink NV12 planes earlier

unlink_nv12_plane() will clobber parts of the plane state
potentially already set up by plane_atomic_check(), so we
must make sure not to call the two in the wrong order.
The problem happens when a plane previously selected as
a Y plane is now configured as a normal plane by user space.
plane_atomic_check() will first compute the proper plane
state based on the userspace request, and unlink_nv12_plane()
later clears some of the state.

This used to work on account of unlink_nv12_plane() skipping
the state clearing based on the plane visibility. But I removed
that check, thinking it was an impossible situation. Now when
that situation happens unlink_nv12_plane() will just WARN
and proceed to clobber the state.

Rather than reverting to the old way of doing things, I think
it's more clear if we unlink the NV12 planes before we even
compute the new plane state.

Cc: stable@vger.kernel.org
Reported-by: Khaled Almahallawy <khaled.almahallawy@intel.com>
Closes: https://lore.kernel.org/intel-gfx/20260212004852.1920270-1-khaled.almahallawy@intel.com/
Tested-by: Khaled Almahallawy <khaled.almahallawy@intel.com>
Fixes: 6a01df2f1b2a ("drm/i915: Remove pointless visible check in unlink_nv12_plane()")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patch.msgid.link/20260316163953.12905-2-ville.syrjala@linux.intel.com
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
5 weeks agoMerge tag 'v7.0-rc4' into timers/core, to resolve conflict
Ingo Molnar [Sat, 21 Mar 2026 07:02:36 +0000 (08:02 +0100)] 
Merge tag 'v7.0-rc4' into timers/core, to resolve conflict

Resolve conflict between this change in the upstream kernel:

  4c652a47722f ("rseq: Mark rseq_arm_slice_extension_timer() __always_inline")

... and this pending change in timers/core:

  0e98eb14814e ("entry: Prepare for deferred hrtimer rearming")

Signed-off-by: Ingo Molnar <mingo@kernel.org>
5 weeks agofbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
Andy Shevchenko [Fri, 20 Mar 2026 14:36:46 +0000 (15:36 +0100)] 
fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break

Clang is not happy about set but unused variable:

drivers/video/fbdev/matrox/g450_pll.c:412:18: error: variable 'mnp' set but not used
   412 |         unsigned int mnp;
       |                      ^
1 error generated.

Since the commit 7b987887f97b ("video: fbdev: matroxfb: remove dead code
and set but not used variable") the 'mnp' became unused, but eliminating
that code might have side-effects. The question here is what should we do
with 'mnp'? The easiest way out is just mark it with __maybe_unused which
will shut the compiler up and won't change any possible IO flow. So does
this change.

A dive into the history of the driver:

The problem was revealed when the #if 0 guarded code along with unused
pixel_vco variable was removed. That code was introduced in the original
commit 213d22146d1f ("[PATCH] (1/3) matroxfb for 2.5.3"). And then guarded
in the commit 705e41f82988 ("matroxfb DVI updates: Handle DVI output on
G450/G550. Powerdown unused portions of G450/G550 DAC. Split G450/G550 DAC
from older DAC1064 handling. Modify PLL setting when both CRTCs use same
pixel clocks.").

NOTE: The two commits mentioned above pre-date Git era and available in
history.git repository for archaeological purposes.

Even without that guard the modern compilers may see that the pixel_vco
wasn't ever used and seems a leftover after some debug or review made
25 years ago.

The g450_mnp2vco() doesn't have any IO and as Jason said doesn't seem
to have any side effects either than some unneeded CPU processing during
runtime. I agree that's unlikely that timeout (or heating up the CPU) has
any effect on the HW (GPU/display) functionality.

Fixes: 7b987887f97b ("video: fbdev: matroxfb: remove dead code and set but not used variable")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>
5 weeks agofbdev: update help text for CONFIG_FB_NVIDIA
robgithub [Thu, 12 Mar 2026 20:55:07 +0000 (20:55 +0000)] 
fbdev: update help text for CONFIG_FB_NVIDIA

The help text for CONFIG_FB_NVIDIA refers to obsolete hardware and
incorrect default behaviour. This patch updates the description to
reflect the current state of the driver and supported devices.

Signed-off-by: robgithub <rob.github@jumpstation.co.uk>
Signed-off-by: Helge Deller <deller@gmx.de>
5 weeks agoaccel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval
Max Zhen [Fri, 20 Mar 2026 21:06:14 +0000 (14:06 -0700)] 
accel/amdxdna: Refactor GEM BO handling and add helper APIs for address retrieval

Refactor amdxdna GEM buffer object (BO) handling to simplify address
management and unify BO type semantics.

Introduce helper APIs to retrieve commonly used BO addresses:
- User virtual address (UVA)
- Kernel virtual address (KVA)
- Device address (IOVA/PA)

These helpers centralize address lookup logic and avoid duplicating
BO-specific handling across submission and execution paths. This also
improves readability and reduces the risk of inconsistent address
handling in future changes.

As part of the refactor:
- Rename SHMEM BO type to SHARE to better reflect its usage.
- Merge CMD BO handling into SHARE, removing special-case logic for
  command buffers.
- Consolidate BO type handling paths to reduce code duplication and
  simplify maintenance.

No functional change is intended. The refactor prepares the driver for
future enhancements by providing a cleaner abstraction for BO address
management.

Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Max Zhen <max.zhen@amd.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260320210615.1973016-1-lizhi.hou@amd.com
5 weeks agovirt: tdx-guest: Fix handling of host controlled 'quote' buffer length
Zubin Mithra [Wed, 18 Mar 2026 13:40:13 +0000 (13:40 +0000)] 
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length

Validate host controlled value `quote_buf->out_len` that determines how
many bytes of the quote are copied out to guest userspace. In TDX
environments with remote attestation, quotes are not considered private,
and can be forwarded to an attestation server.

Catch scenarios where the host specifies a response length larger than
the guest's allocation, or otherwise races modifying the response while
the guest consumes it.

This prevents contents beyond the pages allocated for `quote_buf`
(up to TSM_REPORT_OUTBLOB_MAX) from being read out to guest userspace,
and possibly forwarded in attestation requests.

Recall that some deployments want per-container configs-tsm-report
interfaces, so the leak may cross container protection boundaries, not
just local root.

Fixes: f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS")
Cc: stable@vger.kernel.org
Signed-off-by: Zubin Mithra <zsm@google.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
5 weeks agosoc: hisilicon: kunpeng_hccs: Remove unused input parameter
Huisong Li [Tue, 17 Mar 2026 03:57:46 +0000 (11:57 +0800)] 
soc: hisilicon: kunpeng_hccs: Remove unused input parameter

The 'hdev' parameter of hccs_create_hccs_dir() is unused.
Remove it to fix the compiler warning.

Signed-off-by: Huisong Li <lihuisong@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
5 weeks agosoc: hisilicon: kunpeng_hccs: Fix discard ‘const’ qualifier compiling warning
Huisong Li [Tue, 17 Mar 2026 03:57:45 +0000 (11:57 +0800)] 
soc: hisilicon: kunpeng_hccs: Fix discard ‘const’ qualifier compiling warning

The link_fsm_map has ‘const’ qualifier, but the 'str' pointer
in link_fsm_map is discarded. So add 'const' for this pointer
to fix the compiling warning.

Signed-off-by: Huisong Li <lihuisong@huawei.com>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
5 weeks agoarm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
Shawn Guo [Fri, 27 Feb 2026 07:22:10 +0000 (15:22 +0800)] 
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges

Reboot starts failing on Poplar since commit 8424ecdde7df ("arm64: mm:
Set ZONE_DMA size based on devicetree's dma-ranges"), which effectively
changes zone_dma_bits from 30 to 32 for arm64 platforms that do not
properly define dma-ranges in device tree.  It's unclear how Poplar reboot
gets broken by this change exactly, but a dma-ranges limiting zone_dma to
the first 1 GB fixes the regression.

Fixes: 2f20182ed670 ("arm64: dts: hisilicon: add dts files for hi3798cv200-poplar board")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
5 weeks agoarm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
Shawn Guo [Fri, 27 Feb 2026 07:19:58 +0000 (15:19 +0800)] 
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity

The PCIe reset GPIO on Poplar is actually active low.  The active high
worked before because kernel driver didn't respect the setting from DT.
This is changed since commit 1d26a55fbeb9 ("PCI: histb: Switch to using
gpiod API"), and thus PCIe on Poplar got brken since then.

Fix the problem by correcting the polarity.

Fixes: 32fa01761bd9 ("arm64: dts: hi3798cv200: enable PCIe support for poplar board")
Cc: stable@vger.kernel.org
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Wei Xu <xuwei5@hisilicon.com>
5 weeks agoMerge branch 'netdevsim-support-ets-offload'
Jakub Kicinski [Sat, 21 Mar 2026 03:13:16 +0000 (20:13 -0700)] 
Merge branch 'netdevsim-support-ets-offload'

Davide Caratti says:

====================
netdevsim: support ETS offload

 - patch 1 moves netdevsim tc offloads to a dedicated file
 - patch 2 enables ETS offload on netdevsim
 - patch 3 is a tdc test for ets offload on netdevsim
====================

Link: https://patch.msgid.link/cover.1773945414.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agotc-testing: add a test case for ETS offload
Davide Caratti [Thu, 19 Mar 2026 18:40:56 +0000 (19:40 +0100)] 
tc-testing: add a test case for ETS offload

While reviewing the fix for unintentional u32 overflows in ets offload
code, Jamal said:

 [...]

 > otherwise a tdc test should cover it fine (when you get to the
 > netdevsim change perhaps)

Extend tdc to allow setting hw-tc-offload via ethtool, and
add a test case to reproduce the division by zero fixed in [1].

[1] https://lore.kernel.org/all/CAM0EoMm17wsYZmdFLshH3_-GrZtzd=i0xnoO2yiVB=-N4761mw@mail.gmail.com/

Suggested-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Co-developed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/39129c374cbd00147b8c5afc04db59db62b50acc.1773945414.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonetdevsim: support tc-ets offload
Davide Caratti [Thu, 19 Mar 2026 18:40:55 +0000 (19:40 +0100)] 
netdevsim: support tc-ets offload

Extend netdevsim to accept ndo_setup_tc(TC_SETUP_QDISC_ETS) calls, so that
it's possible to run tdc on ETS offload code path.

Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/d04086cd0204d4aaf6524e972198faa1a4e5d657.1773945414.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonetdevsim: move TC offload code to a dedicated file
Davide Caratti [Thu, 19 Mar 2026 18:40:54 +0000 (19:40 +0100)] 
netdevsim: move TC offload code to a dedicated file

This commit has no functional change.

Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Link: https://patch.msgid.link/b7881fd53f8a5d8eff4eae8121576c3cd60c2ed7.1773945414.git.dcaratti@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: netdevsim: correct typo in new_device_store error message
Alok Tiwari [Thu, 19 Mar 2026 06:08:10 +0000 (23:08 -0700)] 
net: netdevsim: correct typo in new_device_store error message

Fix the format hint by replacing "unit" with "uint" in the pr_err() string.

Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260319060812.495488-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet/mlx5e: Allow set_rx_mode on uplink representor
Saeed Mahameed [Thu, 19 Mar 2026 00:54:56 +0000 (17:54 -0700)] 
net/mlx5e: Allow set_rx_mode on uplink representor

set_rx_mode handler was skipped on uplink representor, since uplink
relies on FDB to forward all traffic to it by default, which works
perfectly on a single PF per physical port configuration, as explicit
mac request isn't required, but In case of multi-host and DPU
environments, uplink can only use own mac address, as set_rx_mode
wasn't honored in uplink rep.

Since MPFs (Multi PF switch) requires PFs to request explicit mac
forwarding, this patch enables set_rx_mode on uplink representor to
allow PF mac programming into MPFs table in switchdev mode, allowing
use-cases such as arbitrary mac address forwarding via linux bridge.

Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260319005456.82745-1-saeed@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: dsa: microchip: Don't embed struct phy_device to maintain the port state
Maxime Chevallier [Thu, 19 Mar 2026 18:17:04 +0000 (19:17 +0100)] 
net: dsa: microchip: Don't embed struct phy_device to maintain the port state

The KSZ9477 maintains the SGMII port's state for speed, duplex and link
status to be able to fixup the accesses to its internal older version of
the Designware XPCS. However, it does so by embedding a full instance of
struct phy_device, only to use the 'speed', 'link' and 'duplex' fields.

This is also only used for the SGMII port, it's otherwise unused for all
other regular ports.

Replace that with simple int/bool values.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260319181705.1576679-1-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge branch 'net-phy-realtek-pair-order-and-polarity'
Jakub Kicinski [Sat, 21 Mar 2026 02:12:48 +0000 (19:12 -0700)] 
Merge branch 'net-phy-realtek-pair-order-and-polarity'

Damien Dejean says:

====================
net: phy: realtek: pair order and polarity

The RTL8224 PHY gives the manufacturer some flexbility with the pair
order and polarity to ease the wiring on the PCB. Then the correct pair
order and pair polarity must be provided to the PHY to function
properly. This series adds the support to configure the pair order and
the pair polarity to the Realtek PHY driver.
====================

Link: https://patch.msgid.link/20260318215502.106528-1-dam.dejean@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: phy: realtek: add RTL8224 polarity support
Damien Dejean [Wed, 18 Mar 2026 21:55:01 +0000 (22:55 +0100)] 
net: phy: realtek: add RTL8224 polarity support

The RTL8224 has a register to configure the polarity of every pair of
each port. It provides device designers more flexbility when wiring the
chip.

Unfortunately, the register is left in an unknown state after a reset.
Thus on devices where the bootloader don't initialize it, the driver has
to do it to detect and use a link.

The MDI polarity swap can be set in the device tree using the property
enet-phy-pair-polarity. The u32 value is a bitfield where bit[0..3]
control the polarity of pairs A..D.

Signed-off-by: Damien Dejean <dam.dejean@gmail.com>
Link: https://patch.msgid.link/20260318215502.106528-5-dam.dejean@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agodt-bindings: net: ethernet-phy: add property enet-phy-pair-polarity
Damien Dejean [Wed, 18 Mar 2026 21:55:00 +0000 (22:55 +0100)] 
dt-bindings: net: ethernet-phy: add property enet-phy-pair-polarity

Add the property enet-phy-pair-polarity to describe the polarity of the
PHY pairs. To ease PCB designs some manufacturers allow to wire the
pairs with a reverse polarity and provide a way to configure it.

The property 'enet-phy-pair-polarity' sets the polarity of each pair.
Bit 0 to 3 configure the polarity or pairs A to D, if set to 1 the
polarity is reversed for this pair.

Signed-off-by: Damien Dejean <dam.dejean@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260318215502.106528-4-dam.dejean@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: phy: realtek: add RTL8224 pair order support
Damien Dejean [Wed, 18 Mar 2026 21:54:59 +0000 (22:54 +0100)] 
net: phy: realtek: add RTL8224 pair order support

The RTL8224 has a register to configure a pair swap (from ABCD order to
DCBA) providing PCB designers more flexbility when wiring the chip. The
swap parameter has to be set correctly for each of the 4 ports before
the chip can detect a link.

After a reset, this register is (unfortunately) left in a random state,
thus it has to be initialized. On most of the devices the bootloader
does it once for all and we can rely on the value set, on some other it
is not and the kernel has to do it.

The MDI pair swap can be set in the device tree using the property
enet-phy-pair-order. The property is set to 0 to keep the default order
(ABCD), or 1 to reverse the pairs (DCBA).

Signed-off-by: Damien Dejean <dam.dejean@gmail.com>
Link: https://patch.msgid.link/20260318215502.106528-3-dam.dejean@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agodt-bindings: net: ethernet-phy: add property enet-phy-pair-order
Damien Dejean [Wed, 18 Mar 2026 21:54:58 +0000 (22:54 +0100)] 
dt-bindings: net: ethernet-phy: add property enet-phy-pair-order

Add property enet-phy-pair-order to the device tree bindings to define
the pair order of the PHY. To simplify PCB design some manufacturers
allow to wire the pairs in a reverse order, and change the order in
software.

The property can be set to 0 to force the normal pair order (ABCD), or 1
to force the reverse pair order (DCBA).

Signed-off-by: Damien Dejean <dam.dejean@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260318215502.106528-2-dam.dejean@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: ethtool: re-order local includes
Maxime Chevallier [Thu, 19 Mar 2026 18:05:54 +0000 (19:05 +0100)] 
net: ethtool: re-order local includes

Most local #include in the ethtool command handling is out of order,
with either :

 #include "netlink.h"
 #include "common.h"

or even :

 #include "netlink.h"
 #include "common.h"
 #include "bitset.h"

One of the reasons is because bitset.h s lacking definitions for
nlattr, netlink_ext_ack, ETH_GSTRING_LEN, and types such as u32, bool,
etc.

Make bitset.h standalone by including <linux/ethtool.h> for
ETH_GSTRING_LEN, and <linux/netlink.h> for nlattr, netlink_ext_ack and
the rest.

While at it, take a pass on ethnl sources to re-order the local
includes :
 - put them after the global includes
 - add a newline between global and local includes
 - alpha-sort the local includes

One notable exception is the cmis.h include, that needs definitions from
module_fw.h. Keep them in this order for now.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/20260319180555.1531386-1-maxime.chevallier@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge branch 'net-bcmasp-fix-issues-during-driver-unbind'
Jakub Kicinski [Sat, 21 Mar 2026 02:07:33 +0000 (19:07 -0700)] 
Merge branch 'net-bcmasp-fix-issues-during-driver-unbind'

Justin Chen says:

====================
net: bcmasp: Fix issues during driver unbind

Fix two issues when we unbind the driver. We hit a double free of the
WoL irq and a double disable of the clk.
====================

Link: https://patch.msgid.link/20260319234813.1937315-1-justin.chen@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: bcmasp: fix double disable of clk
Justin Chen [Thu, 19 Mar 2026 23:48:13 +0000 (16:48 -0700)] 
net: bcmasp: fix double disable of clk

Switch to devm_clk_get_optional() so we can manage the clock ourselves.
We dynamically control the clocks depending on the state of the interface
for power savings. The default state is clock disabled, so unbinding the
driver causes a double disable.

Fixes: 490cb412007d ("net: bcmasp: Add support for ASP2.0 Ethernet controller")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260319234813.1937315-3-justin.chen@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: bcmasp: fix double free of WoL irq
Justin Chen [Thu, 19 Mar 2026 23:48:12 +0000 (16:48 -0700)] 
net: bcmasp: fix double free of WoL irq

We do not need to free wol_irq since it was instantiated with
devm_request_irq(). So devres will free for us.

Fixes: a2f0751206b0 ("net: bcmasp: Add support for WoL magic packet")
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260319234813.1937315-2-justin.chen@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge branch 'rtnetlink-add-missing-attributes-in-if_nlmsg_size'
Jakub Kicinski [Sat, 21 Mar 2026 02:05:14 +0000 (19:05 -0700)] 
Merge branch 'rtnetlink-add-missing-attributes-in-if_nlmsg_size'

Sabrina Dubroca says:

====================
rtnetlink: add missing attributes in if_nlmsg_size

Once again we have some attributes added by rtnl_fill_ifinfo() that
aren't counted in if_nlmsg_size().
====================

Link: https://patch.msgid.link/cover.1773919462.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agortnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
Sabrina Dubroca [Thu, 19 Mar 2026 23:02:53 +0000 (00:02 +0100)] 
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size

rtnl_link_get_slave_info_data_size counts IFLA_INFO_SLAVE_DATA, but
rtnl_link_slave_info_fill adds both IFLA_INFO_SLAVE_DATA and
IFLA_INFO_SLAVE_KIND.

Fixes: ba7d49b1f0f8 ("rtnetlink: provide api for getting and setting slave info")
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/049843b532e23cde7ddba263c0bbe35ba6f0d26d.1773919462.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agortnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size
Sabrina Dubroca [Thu, 19 Mar 2026 23:02:52 +0000 (00:02 +0100)] 
rtnetlink: count IFLA_PARENT_DEV_{NAME,BUS_NAME} in if_nlmsg_size

Commit 00e77ed8e64d ("rtnetlink: add IFLA_PARENT_[DEV|DEV_BUS]_NAME")
added those attributes to rtnl_fill_ifinfo, but forgot to extend
if_nlmsg_size.

Fixes: 00e77ed8e64d ("rtnetlink: add IFLA_PARENT_[DEV|DEV_BUS]_NAME")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/0b849da95562af45487080528d60f578636aba5c.1773919462.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
Qi Tang [Wed, 18 Mar 2026 06:48:47 +0000 (14:48 +0800)] 
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

smc_rx_splice() allocates one smc_spd_priv per pipe_buffer and stores
the pointer in pipe_buffer.private.  The pipe_buf_operations for these
buffers used .get = generic_pipe_buf_get, which only increments the page
reference count when tee(2) duplicates a pipe buffer.  The smc_spd_priv
pointer itself was not handled, so after tee() both the original and the
cloned pipe_buffer share the same smc_spd_priv *.

When both pipes are subsequently released, smc_rx_pipe_buf_release() is
called twice against the same object:

  1st call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [correct]
  2nd call: kfree(priv)  sock_put(sk)  smc_rx_update_cons()  [UAF]

KASAN reports a slab-use-after-free in smc_rx_pipe_buf_release(), which
then escalates to a NULL-pointer dereference and kernel panic via
smc_rx_update_consumer() when it chases the freed priv->smc pointer:

  BUG: KASAN: slab-use-after-free in smc_rx_pipe_buf_release+0x78/0x2a0
  Read of size 8 at addr ffff888004a45740 by task smc_splice_tee_/74
  Call Trace:
   <TASK>
   dump_stack_lvl+0x53/0x70
   print_report+0xce/0x650
   kasan_report+0xc6/0x100
   smc_rx_pipe_buf_release+0x78/0x2a0
   free_pipe_info+0xd4/0x130
   pipe_release+0x142/0x160
   __fput+0x1c6/0x490
   __x64_sys_close+0x4f/0x90
   do_syscall_64+0xa6/0x1a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

  BUG: kernel NULL pointer dereference, address: 0000000000000020
  RIP: 0010:smc_rx_update_consumer+0x8d/0x350
  Call Trace:
   <TASK>
   smc_rx_pipe_buf_release+0x121/0x2a0
   free_pipe_info+0xd4/0x130
   pipe_release+0x142/0x160
   __fput+0x1c6/0x490
   __x64_sys_close+0x4f/0x90
   do_syscall_64+0xa6/0x1a0
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>
  Kernel panic - not syncing: Fatal exception

Beyond the memory-safety problem, duplicating an SMC splice buffer is
semantically questionable: smc_rx_update_cons() would advance the
consumer cursor twice for the same data, corrupting receive-window
accounting.  A refcount on smc_spd_priv could fix the double-free, but
the cursor-accounting issue would still need to be addressed separately.

The .get callback is invoked by both tee(2) and splice_pipe_to_pipe()
for partial transfers; both will now return -EFAULT.  Users who need
to duplicate SMC socket data must use a copy-based read path.

Fixes: 9014db202cb7 ("smc: add support for splice()")
Signed-off-by: Qi Tang <tpluszz77@gmail.com>
Link: https://patch.msgid.link/20260318064847.23341-1-tpluszz77@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: lan743x: fix SGMII detection on PCI1xxxx B0+ during warm reset
Thangaraj Samynathan [Wed, 18 Mar 2026 06:32:28 +0000 (12:02 +0530)] 
net: lan743x: fix SGMII detection on PCI1xxxx B0+ during warm reset

A warm reset on boards using an EEPROM-only strap configuration (where
no MAC address is set in the image) can cause the driver to incorrectly
revert to RGMII mode. This occurs because the ENET_CONFIG_LOAD_STARTED
bit may not persist or behave as expected.

Update pci11x1x_strap_get_status() to use revision-specific validation:

- For PCI11x1x A0: Continue using the legacy check (config load started
  or reset protection) to validate the SGMII strap.
- For PCI11x1x B0 and later: Use the newly available
  STRAP_READ_USE_SGMII_EN_ bit in the upper strap register to validate
  the lower SGMII_EN bit.

This ensures the SGMII interface is correctly identified even after a
warm reboot.

Signed-off-by: Thangaraj Samynathan <thangaraj.s@microchip.com>
Link: https://patch.msgid.link/20260318063228.17110-1-thangaraj.s@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoopenvswitch: validate MPLS set/set_masked payload length
Yang Yang [Thu, 19 Mar 2026 08:02:27 +0000 (08:02 +0000)] 
openvswitch: validate MPLS set/set_masked payload length

validate_set() accepted OVS_KEY_ATTR_MPLS as variable-sized payload for
SET/SET_MASKED actions. In action handling, OVS expects fixed-size
MPLS key data (struct ovs_key_mpls).

Use the already normalized key_len (masked case included) and reject
non-matching MPLS action key sizes.

Reject invalid MPLS action payload lengths early.

Fixes: fbdcdd78da7c ("Change in Openvswitch to support MPLS label depth of 3 in ingress direction")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260319080228.3423307-1-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoopenvswitch: defer tunnel netdev_put to RCU release
Yang Yang [Thu, 19 Mar 2026 07:42:41 +0000 (07:42 +0000)] 
openvswitch: defer tunnel netdev_put to RCU release

ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already
detached the device. Dropping the netdev reference in destroy can race
with concurrent readers that still observe vport->dev.

Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let
vport_netdev_free() drop the reference from the RCU callback, matching
the non-tunnel destroy path and avoiding additional synchronization
under RTNL.

Fixes: a9020fde67a6 ("openvswitch: Move tunnel destroy function to oppenvswitch module.")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Tested-by: Ao Zhou <n05ec@lzu.edu.cn>
Co-developed-by: Yuan Tan <tanyuan98@outlook.com>
Signed-off-by: Yuan Tan <tanyuan98@outlook.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Yang Yang <n05ec@lzu.edu.cn>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260319074241.3405262-1-n05ec@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge branch 'selftests-vsock-support-nested-vm-runner-for-vmtest-sh'
Jakub Kicinski [Sat, 21 Mar 2026 01:34:50 +0000 (18:34 -0700)] 
Merge branch 'selftests-vsock-support-nested-vm-runner-for-vmtest-sh'

Bobby Eshleman says:

====================
selftests/vsock: support nested VM runner for vmtest.sh

This series fixes a few issues trying to launch vmtest.sh in a nested VM
environment and were discovered when trying to prepare the tests for
netdev CI/CD.

When taken together these patches make vmtest.sh work both on bare metal
and in nested VMs, regardless of the outer VM's user, coincidental path
overlaps, or filesystem settings.
====================

Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-0-0b3f53b80a0f@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoselftests/vsock: fix vsock_test path shadowing in nested VMs
Bobby Eshleman [Tue, 17 Mar 2026 22:09:36 +0000 (15:09 -0700)] 
selftests/vsock: fix vsock_test path shadowing in nested VMs

The /root mount introduced for nested VM support shadows any host paths
under /root. This breaks systems where the outer VM runs as root and the
vsock_test binary path is something like:

/root/linux/tools/testing/selftests/vsock/vsock_test

Fix this by copying vsock_test into the temporary home directory that
gets mounted as /root in the guest, and using a relative path to invoke
it.

Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-2-0b3f53b80a0f@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoselftests/vsock: fix vmtest.sh for read-only nested VM runners
Bobby Eshleman [Tue, 17 Mar 2026 22:09:35 +0000 (15:09 -0700)] 
selftests/vsock: fix vmtest.sh for read-only nested VM runners

When running vmtest.sh inside a nested VM, there occurs a problem
with stacking two sets of virtiofs/overlay layers (the first set from
the outer VM and the second set from the inner VM). The virtme init
scripts (sshd, udhcpd, etc...) fail to execute basic programs (e.g.,
/bin/cat) and load library dependencies (e.g., libpam) due to ESTALE.
This only occurs when both layers (outer and inner) use virtiofs. Work
around this by using 9p in the inner VM via --force-9p.

Additionally, when the outer VM is read-only, the inner VM's attempt at
populating SSH keys to the root filesystem fails:

virtme-ng-init: mkdir: cannot create directory '/root/.cache': Read-only file system

Work around this by creating a temporary home directory with generated
SSH keys and passing it through to the guest as /root via --rwdir.
Disable strict host key checking in vm_ssh() since the VM will be seen
as a new host each run.

The --rw arg had to be removed to prevent a vng complaint about overlay
(in combination with the other parameters). The guest doesn't really
need write access anyway, so this was probably overly permissive to
begin with.

Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260317-vsock-vmtest-nested-fixes-v2-1-0b3f53b80a0f@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agobonding: remove bonding_priv.h
Breno Leitao [Wed, 18 Mar 2026 12:22:48 +0000 (05:22 -0700)] 
bonding: remove bonding_priv.h

bonding_priv.h only defined DRV_NAME and DRV_DESCRIPTION, but caused
unnecessary recompilation: it included <generated/utsrelease.h> to
define bond_version, which is used solely in bond_procfs.c. With
CONFIG_LOCALVERSION_AUTO=y, utsrelease.h is regenerated on every git
commit, so any git operation triggered recompilation of bond_main.c
which also included bonding_priv.h.

Remove the header entirely, as suggested by Jakub, given the macros on
this file can be integrated into the C files directly.

Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260318-bond_uts-v2-1-033fe0d4e903@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: phylink: add debug for phy_config_inband()
Russell King (Oracle) [Wed, 18 Mar 2026 08:27:44 +0000 (08:27 +0000)] 
net: phylink: add debug for phy_config_inband()

Add debug for the phy_config_inband() call so we can see which inband
modes are being configured at the PHY.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/E1w2mFk-0000000DXW2-2PR9@rmk-PC.armlinux.org.uk
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init()
Lorenzo Bianconi [Tue, 17 Mar 2026 16:40:47 +0000 (17:40 +0100)] 
net: airoha: Reset PPE cpu port configuration in airoha_ppe_hw_init()

Before this patch, the PPE cpu port configuration used for a specific GDM
device was set just running ndo_init() callback during the device
initialization. The selected PPE cpu port configuration depends on the QDMA
block assigned to the GDM port. The QDMA block is selected according to
the GDM port LAN/WAN configuration as specified in the commit
'8737d7194d6d ("net: airoha: select QDMA block according LAN/WAN
configuration"). However, the user selected PPE cpu port configuration can
be different with respect to the one hardcoded in the NPU firmware binary.
The hardcoded NPU PPE cpu port configuration is loaded initializing the PPE
engine running the NPU ops ppe_init() callback in airoha_ppe_offload_setup
routine (this is executed at runtime by the netfilter flowtable
infrastructure during flow offloading).
Reset the PPE cpu port configuration in airoha_ppe_hw_init routine in
order to apply the user requested setup according to the device DTS.
Please note this patch is fixing an issue not visible to the user (so we
do not need to backport it) since airoha_eth driver currently supports just
the internal phy available via the MT7530 DSA switch and there are no WAN
interfaces officially supported since PCS/external phy is not merged
mainline yet (it will be posted with following patches).

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260317-airoha-fix-ppe-def-cpu-v1-1-338533d8e234@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: dsa: mxl862xx: don't read out-of-bounds
Daniel Golle [Wed, 18 Mar 2026 03:07:52 +0000 (03:07 +0000)] 
net: dsa: mxl862xx: don't read out-of-bounds

The write loop in mxl862xx_api_wrap() computes the word count as
(size + 1) / 2, rounding up for odd-sized structs.

On the last iteration of an odd-sized buffer it reads a full __le16
from data[i], accessing one byte past the end of the caller's struct.
KASAN catches this as a stack-out-of-bounds read during probe (e.g.
from mxl862xx_bridge_config_fwd() because of the odd length of
sizeof(struct mxl862xx_bridge_config) == 49).

The read-back loop already handles this case, it writes only a single
byte when (i * 2 + 1) == size. The write loop lacked the same guard.

In practice the over-read is harmless: the extra stack byte is sent to
the firmware which ignores trailing data beyond the command's declared
payload size.

Apply the same odd-size last-byte handling to the write path: when the
final word contains only one valid byte, send *(u8 *)&data[i] instead
of le16_to_cpu(data[i]). This is endian-safe because data is
__le16-encoded and the low byte is always at the lowest address
regardless of host byte order.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/83356ad9c9a4470dd49b6b3d661c2a8dd85cc6a1.1773803190.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge branch 'net-macb-fix-two-lock-warnings-when-wol-is-used'
Jakub Kicinski [Sat, 21 Mar 2026 01:25:03 +0000 (18:25 -0700)] 
Merge branch 'net-macb-fix-two-lock-warnings-when-wol-is-used'

Kevin Hao says:

====================
net: macb: Fix two lock warnings when WOL is used

This patch series addresses two lock warnings that occur when using WOL as a
wakeup source on my AMD ZynqMP board.
====================

Link: https://patch.msgid.link/20260318-macb-irq-v2-0-f1179768ab24@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: macb: Protect access to net_device::ip_ptr with RCU lock
Kevin Hao [Wed, 18 Mar 2026 06:36:59 +0000 (14:36 +0800)] 
net: macb: Protect access to net_device::ip_ptr with RCU lock

Access to net_device::ip_ptr and its associated members must be
protected by an RCU lock. Since we are modifying this piece of code,
let's also move it to execute only when WAKE_ARP is enabled.

To minimize the duration of the RCU lock, a local variable is used to
temporarily store the IP address. This change resolves the following
RCU check warning:
  WARNING: suspicious RCU usage
  7.0.0-rc3-next-20260310-yocto-standard+ #122 Not tainted
  -----------------------------
  drivers/net/ethernet/cadence/macb_main.c:5944 suspicious rcu_dereference_check() usage!

  other info that might help us debug this:

  rcu_scheduler_active = 2, debug_locks = 1
  5 locks held by rtcwake/518:
   #0: ffff000803ab1408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368
   #1: ffff0008090bf088 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8
   #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8
   #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290
   #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0

  stack backtrace:
  CPU: 3 UID: 0 PID: 518 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #122 PREEMPT
  Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
  Call trace:
   show_stack+0x24/0x38 (C)
   __dump_stack+0x28/0x38
   dump_stack_lvl+0x64/0x88
   dump_stack+0x18/0x24
   lockdep_rcu_suspicious+0x134/0x1d8
   macb_suspend+0xd8/0x4c0
   device_suspend+0x218/0x4f0
   dpm_suspend+0x244/0x3a0
   dpm_suspend_start+0x50/0x78
   suspend_devices_and_enter+0xec/0x560
   pm_suspend+0x194/0x290
   state_store+0x110/0x158
   kobj_attr_store+0x1c/0x30
   sysfs_kf_write+0xa8/0xd0
   kernfs_fop_write_iter+0x11c/0x1c8
   vfs_write+0x248/0x368
   ksys_write+0x7c/0xf8
   __arm64_sys_write+0x28/0x40
   invoke_syscall+0x4c/0xe8
   el0_svc_common+0x98/0xf0
   do_el0_svc+0x28/0x40
   el0_svc+0x54/0x1e0
   el0t_64_sync_handler+0x84/0x130
   el0t_64_sync+0x198/0x1a0

Fixes: 0cb8de39a776 ("net: macb: Add ARP support to WOL")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/20260318-macb-irq-v2-2-f1179768ab24@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agonet: macb: Move devm_{free,request}_irq() out of spin lock area
Kevin Hao [Wed, 18 Mar 2026 06:36:58 +0000 (14:36 +0800)] 
net: macb: Move devm_{free,request}_irq() out of spin lock area

The devm_free_irq() and devm_request_irq() functions should not be
executed in an atomic context.

During device suspend, all userspace processes and most kernel threads
are frozen. Additionally, we flush all tx/rx status, disable all macb
interrupts, and halt rx operations. Therefore, it is safe to split the
region protected by bp->lock into two independent sections, allowing
devm_free_irq() and devm_request_irq() to run in a non-atomic context.
This modification resolves the following lockdep warning:
  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
  in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 501, name: rtcwake
  preempt_count: 1, expected: 0
  RCU nest depth: 1, expected: 0
  7 locks held by rtcwake/501:
   #0: ffff0008038c3408 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0xf8/0x368
   #1: ffff0008049a5e88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0xbc/0x1c8
   #2: ffff00080098d588 (kn->active#70){.+.+}-{0:0}, at: kernfs_fop_write_iter+0xcc/0x1c8
   #3: ffff800081c84888 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0x1ec/0x290
   #4: ffff0008009ba0f8 (&dev->mutex){....}-{4:4}, at: device_suspend+0x118/0x4f0
   #5: ffff800081d00458 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48
   #6: ffff0008031fb9e0 (&bp->lock){-.-.}-{3:3}, at: macb_suspend+0x144/0x558
  irq event stamp: 8682
  hardirqs last  enabled at (8681): [<ffff8000813c7d7c>] _raw_spin_unlock_irqrestore+0x44/0x88
  hardirqs last disabled at (8682): [<ffff8000813c7b58>] _raw_spin_lock_irqsave+0x38/0x98
  softirqs last  enabled at (7322): [<ffff8000800f1b4c>] handle_softirqs+0x52c/0x588
  softirqs last disabled at (7317): [<ffff800080010310>] __do_softirq+0x20/0x2c
  CPU: 1 UID: 0 PID: 501 Comm: rtcwake Not tainted 7.0.0-rc3-next-20260310-yocto-standard+ #125 PREEMPT
  Hardware name: ZynqMP ZCU102 Rev1.1 (DT)
  Call trace:
   show_stack+0x24/0x38 (C)
   __dump_stack+0x28/0x38
   dump_stack_lvl+0x64/0x88
   dump_stack+0x18/0x24
   __might_resched+0x200/0x218
   __might_sleep+0x38/0x98
   __mutex_lock_common+0x7c/0x1378
   mutex_lock_nested+0x38/0x50
   free_irq+0x68/0x2b0
   devm_irq_release+0x24/0x38
   devres_release+0x40/0x80
   devm_free_irq+0x48/0x88
   macb_suspend+0x298/0x558
   device_suspend+0x218/0x4f0
   dpm_suspend+0x244/0x3a0
   dpm_suspend_start+0x50/0x78
   suspend_devices_and_enter+0xec/0x560
   pm_suspend+0x194/0x290
   state_store+0x110/0x158
   kobj_attr_store+0x1c/0x30
   sysfs_kf_write+0xa8/0xd0
   kernfs_fop_write_iter+0x11c/0x1c8
   vfs_write+0x248/0x368
   ksys_write+0x7c/0xf8
   __arm64_sys_write+0x28/0x40
   invoke_syscall+0x4c/0xe8
   el0_svc_common+0x98/0xf0
   do_el0_svc+0x28/0x40
   el0_svc+0x54/0x1e0
   el0t_64_sync_handler+0x84/0x130
   el0t_64_sync+0x198/0x1a0

Fixes: 558e35ccfe95 ("net: macb: WoL support for GEM type of Ethernet controller")
Cc: stable@vger.kernel.org
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Link: https://patch.msgid.link/20260318-macb-irq-v2-1-f1179768ab24@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
5 weeks agoMerge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel
Linus Torvalds [Sat, 21 Mar 2026 01:21:27 +0000 (18:21 -0700)] 
Merge tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular weekly pull request, from sunny San Diego. Usual suspects in
  xe/i915/amdgpu with small fixes all over, then some minor fixes across
  a few other drivers. It's probably a bit on the heavy side, but most
  of the fix seem well contained,

  core:
   - drm_dev_unplug UAF fix

  pagemap:
   - lock handling fix

  xe:
   - A number of teardown fixes
   - Skip over non-leaf PTE for PRL generation
   - Fix an uninitialized variable
   - Fix a missing runtime PM reference

  i915/display:
   - Fix #15771: Screen corruption and stuttering on P14s w/ 3K display
   - Fix for PSR entry setup frames count on rejected commit
   - Fix OOPS if firmware is not loaded and suspend is attempted
   - Fix unlikely NULL deref due to DC6 on probe

  amdgpu:
   - Fix gamma 2.2 colorop TFs
   - BO list fix
   - LTO fix
   - DC FP fix
   - DisplayID handling fix
   - DCN 2.01 fix
   - MMHUB boundary fixes
   - ISP fix
   - TLB fence fix
   - Hainan pm fix

  radeon:
   - Hainan pm fix

  vmwgfx:
   - memory leak fix
   - doc warning fix

  imagination:
   - deadlock fix
   - interrupt handling fixes

  dw-hdmi-qp:
   - multi channel audio fix"

* tag 'drm-fixes-2026-03-21' of https://gitlab.freedesktop.org/drm/kernel: (40 commits)
  drm/xe: Fix missing runtime PM reference in ccs_mode_store
  drm/xe: Open-code GGTT MMIO access protection
  drm/xe/lrc: Fix uninitialized new_ts when capturing context timestamp
  drm/xe/oa: Allow reading after disabling OA stream
  drm/xe: Skip over non leaf pte for PRL generation
  drm/xe/guc: Ensure CT state transitions via STOP before DISABLED
  drm/xe: Trigger queue cleanup if not in wedged mode 2
  drm/xe: Forcefully tear down exec queues in GuC submit fini
  drm/xe: Always kill exec queues in xe_guc_submit_pause_abort
  drm/xe/guc: Fail immediately on GuC load error
  drm/i915/gt: Check set_default_submission() before deferencing
  drm/radeon: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: apply state adjust rules to some additional HAINAN vairants
  drm/amdgpu: rework how we handle TLB fences
  drm/bridge: dw-hdmi-qp: fix multi-channel audio output
  drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug
  drm/amdgpu: Fix ISP segfault issue in kernel v7.0
  drm/amdgpu/gmc9.0: add bounds checking for cid
  drm/amdgpu/mmhub4.2.0: add bounds checking for cid
  drm/amdgpu/mmhub4.1.0: add bounds checking for cid
  ...

5 weeks agoARM: dts: BCM5301X: EA9200: specify partitions
Rosen Penev [Thu, 19 Mar 2026 03:53:23 +0000 (20:53 -0700)] 
ARM: dts: BCM5301X: EA9200: specify partitions

Some are needed to be specified so that linksys,ns-firmware works
properly.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260319035324.269905-6-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: EA9200: add LEDs
Rosen Penev [Thu, 19 Mar 2026 03:53:21 +0000 (20:53 -0700)] 
ARM: dts: BCM5301X: EA9200: add LEDs

Allows control and configuration of device LEDs.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260319035324.269905-4-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: EA9200: add USB GPIOs
Rosen Penev [Thu, 19 Mar 2026 03:53:20 +0000 (20:53 -0700)] 
ARM: dts: BCM5301X: EA9200: add USB GPIOs

Allows at least halt to turn the USB ports off.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260319035324.269905-3-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: EA9200: add WiFi button
Rosen Penev [Thu, 19 Mar 2026 03:53:19 +0000 (20:53 -0700)] 
ARM: dts: BCM5301X: EA9200: add WiFi button

Adds ability to configure the WiFi button.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260319035324.269905-2-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: broadcom: bcm2835-rpi: Move non simple-bus nodes to root level
Rob Herring (Arm) [Fri, 20 Mar 2026 15:48:06 +0000 (10:48 -0500)] 
ARM: dts: broadcom: bcm2835-rpi: Move non simple-bus nodes to root level

The 'gpu' and 'firmware' nodes are not MMIO devices, so they should not be
under a 'simple-bus'. Additionally, the "raspberrypi,bcm2835-power" node
is part of the firmware, so move it under the 'rpi-firmware' node.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260320154809.1246064-1-robh@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm63148: Add I2C block
Linus Walleij [Wed, 18 Feb 2026 09:30:54 +0000 (10:30 +0100)] 
ARM: dts: bcm63148: Add I2C block

The BCM63148 has a brcmper I2C block.

The peripheral range needs to be extended to accommodate
it. The Boot LUT is at offset + 0x10000 so extend it to
cover at least that too, 128 KB.

INTERRUPT_ID_I2C is at (ISR_TABLE3_OFFSET + 19) = 96+19 = 115,
convert back to SPI IRQ 115-32 = 83.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-7-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm63138: Add I2C block
Linus Walleij [Wed, 18 Feb 2026 09:30:53 +0000 (10:30 +0100)] 
ARM: dts: bcm63138: Add I2C block

The BCM63138 has a brcmper I2C block.

The interrupt is at INTERRUPT_ID_I2C whic is
(ISR_TABLE3_OFFSET + 19) = 96+115, convert back
to SPI interrupt 115-32 = 83.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-6-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm6878: Add I2C bus block
Linus Walleij [Wed, 18 Feb 2026 09:30:52 +0000 (10:30 +0100)] 
ARM: dts: bcm6878: Add I2C bus block

The BCM6878 has an brcmper I2C block.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-5-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm6855: Add I2C bus blocks
Linus Walleij [Wed, 18 Feb 2026 09:30:51 +0000 (10:30 +0100)] 
ARM: dts: bcm6855: Add I2C bus blocks

The BCM6855 has two brcmper I2C blocks, the second one in
the PERF1 area at 0xff85a800, this is covered by the
current bus range.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-4-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm6846: Add I2C bus block
Linus Walleij [Wed, 18 Feb 2026 09:30:50 +0000 (10:30 +0100)] 
ARM: dts: bcm6846: Add I2C bus block

The BCM6846 has a brcmper I2C block.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-3-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm63138: Fix DMA IRQ
Linus Walleij [Wed, 18 Feb 2026 09:30:49 +0000 (10:30 +0100)] 
ARM: dts: bcm63138: Fix DMA IRQ

INTERRUPT_ID_PL081 is (ISR_TABLE_3_OFFSET + 23)
which is 96+3 = 119, convert back to SPI interrupt
119-32 = 87.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: William Zhang <william.zhang@broadcom.com>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-2-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: bcm6878: Fix PL081 DMA block IRQ
Linus Walleij [Wed, 18 Feb 2026 09:30:48 +0000 (10:30 +0100)] 
ARM: dts: bcm6878: Fix PL081 DMA block IRQ

SPI_TABLE_OFFSET_2 is 96 in 6878.  96+30 = 126.
Convert back dtsi SPI interrupt 126 - 32 = 94

Reviewed-by: William Zhang <william.zhang@broadcom.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20260218-bcmbca-i2c-dts-v2-1-5373ef82c50c@kernel.org
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: AC5300: set WAN MAC from nvram
Rosen Penev [Wed, 25 Feb 2026 23:08:27 +0000 (15:08 -0800)] 
ARM: dts: BCM5301X: AC5300: set WAN MAC from nvram

The WAN MAC is offset by 1. Set in dts to avoid having to handle this in
userspace.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260225230827.21715-5-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: AC3100: set WAN MAC from nvram
Rosen Penev [Wed, 25 Feb 2026 23:08:26 +0000 (15:08 -0800)] 
ARM: dts: BCM5301X: AC3100: set WAN MAC from nvram

The WAN MAC is offset by 1. Set it to avoid having to do so in
userspace.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260225230827.21715-4-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: panamera: set WAN MAC from nvram
Rosen Penev [Wed, 25 Feb 2026 23:08:25 +0000 (15:08 -0800)] 
ARM: dts: BCM5301X: panamera: set WAN MAC from nvram

The MAC address from the stock firmware is offset by 1. Define it
properly to avoid having to override it in userspace.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260225230827.21715-3-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agoARM: dts: BCM5301X: EA9200: set WAN MAC from nvram
Rosen Penev [Wed, 25 Feb 2026 23:08:24 +0000 (15:08 -0800)] 
ARM: dts: BCM5301X: EA9200: set WAN MAC from nvram

The MAC address from the stock firmware is offset by 1. Define it
properly to avoid having to override it in userspace.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20260225230827.21715-2-rosenp@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
5 weeks agohwmon: (max6639) Fix pulses-per-revolution implementation
Guenter Roeck [Fri, 20 Mar 2026 04:31:22 +0000 (21:31 -0700)] 
hwmon: (max6639) Fix pulses-per-revolution implementation

The valid range for the pulses-per-revolution devicetree property is
1..4. The current code checks for a range of 1..5. Fix it.

Declare the variable used to retrieve pulses per revolution from
devicetree as u32 (unsigned) to match the of_property_read_u32() API.

The current code uses a postfix decrement when writing the pulses per
resolution into the chip. This has no effect since the value is evaluated
before it is decremented. Fix it by decrementing before evaluating the
value.

Fixes: 7506ebcd662b ("hwmon: (max6639) : Configure based on DT property")
Cc: Naresh Solanki <naresh.solanki@9elements.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
6 weeks agodt-bindings: i2c: renesas,riic: Document the R9A08G046 support
Biju Das [Wed, 4 Mar 2026 07:17:28 +0000 (07:17 +0000)] 
dt-bindings: i2c: renesas,riic: Document the R9A08G046 support

Document the Renesas RZ/G3L (R9A08G046) RIIC IP. This is compatible with
the version available on Renesas RZ/V2H (R9A09G057).

Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
6 weeks agodt-bindings: i2c: qcom-cci: Document sm6150 compatible
Wenmeng Liu [Thu, 5 Mar 2026 09:48:12 +0000 (17:48 +0800)] 
dt-bindings: i2c: qcom-cci: Document sm6150 compatible

Add the sm6150 CCI device string compatible.

Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
6 weeks agoi2c: cp2615: rename disconnect callback
Johan Hovold [Fri, 6 Mar 2026 09:41:14 +0000 (10:41 +0100)] 
i2c: cp2615: rename disconnect callback

Rename the driver disconnect function so that it reflects the callback
name for consistency with the rest of the kernel (e.g. makes it easier
to grep for).

Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
6 weeks agodt-bindings: i2c: qcom-cci: Document Milos compatible
Luca Weiss [Fri, 20 Mar 2026 08:09:49 +0000 (09:09 +0100)] 
dt-bindings: i2c: qcom-cci: Document Milos compatible

Add Milos compatible for the CAMSS CCI interfaces.

Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
6 weeks agocheck-uapi: use dummy libc includes
Arnd Bergmann [Fri, 6 Mar 2026 16:33:09 +0000 (17:33 +0100)] 
check-uapi: use dummy libc includes

Based on Thomas Weißschuh's series to kernel headers to no longer require
an installed libc when build testing the uapi headers, the same can now
be done for the scripts/check-uapi.sh script.

The only required change here is to add the  usr/dummy-include include
path.

Link: https://lore.kernel.org/lkml/20260227-kbuild-uapi-libc-v1-0-c17de0d19776@weissschuh.net/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260306163309.2015837-4-arnd@kernel.org
Signed-off-by: Nicolas Schier <nsc@kernel.org>
6 weeks agocheck-uapi: honor ${CROSS_COMPILE} setting
Arnd Bergmann [Fri, 6 Mar 2026 16:33:08 +0000 (17:33 +0100)] 
check-uapi: honor ${CROSS_COMPILE} setting

When ${CROSS_COMPILE} is set, but ${CC} is not set, the logic in
check-uapi.sh is different from the top-level Makefile, which defaults
to using the cross gcc. This leads to using the native gcc instead of the
cross version, resulting in unexpected false-positive and false-negative
output.

Use the same logic here that we use in Kbuild for consistency.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260306163309.2015837-3-arnd@kernel.org
Signed-off-by: Nicolas Schier <nsc@kernel.org>
6 weeks agocheck-uapi: link into shared objects
Arnd Bergmann [Fri, 6 Mar 2026 16:33:07 +0000 (17:33 +0100)] 
check-uapi: link into shared objects

While testing ABI changes across all architectures, I found that abidiff
sometimes produces nonsensical output. Further debugging identified
missing or broken libelf support for architecture specific relocations
in ET_REL binaries as the source of the problem[1].

Change the script to no longer produce a relocatable object file but
instead create a shared library for each header. This makes abidiff
work for all of the architectures in upstream linux kernels.

Link: https://sourceware.org/bugzilla/show_bug.cgi?id=33869
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260306163309.2015837-2-arnd@kernel.org
Signed-off-by: Nicolas Schier <nsc@kernel.org>
6 weeks agovfio: selftests: Support DMR and GNR-D DSA devices
Yi Lai [Fri, 20 Mar 2026 01:09:29 +0000 (09:09 +0800)] 
vfio: selftests: Support DMR and GNR-D DSA devices

Currently, the VFIO DSA driver test only supports the SPR DSA device ID.
Attempting to run the test on newer platforms like DMR or GNR-D results
in a "No driver found" error, causing the test to be skipped.

Refactor dsa_probe() to use a switch statement for checking device IDs.
This improves maintainability and makes it easier to add new device IDs
in the future.

Add the following DSA device IDs to the supported list:
PCI_DEVICE_ID_INTEL_DSA_DMR  (0x1212)
PCI_DEVICE_ID_INTEL_DSA_GNRD (0x11fb)

Signed-off-by: Yi Lai <yi1.lai@intel.com>
Reviewed-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260320010930.481380-1-yi1.lai@intel.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
6 weeks agovfio: selftests: Build tests on aarch64
Ted Logan [Thu, 19 Mar 2026 22:58:47 +0000 (15:58 -0700)] 
vfio: selftests: Build tests on aarch64

Fix vfio selftests on aarch64, allowing native builds on aarch64 hosts.

Reported-by: Matt Evans <mattev@meta.com>
Closes: https://lore.kernel.org/all/e51b4ff2-13c4-47d4-b781-3dcbd740d274@meta.com/
Fixes: a55d4bbbe644 ("vfio: selftests: only build tests on arm64 and x86_64")
Signed-off-by: Ted Logan <tedlogan@fb.com>
Reviewed-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260319-vfio-selftests-aarch64-v2-1-bb2621c24dc4@fb.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
6 weeks agoMerge tag 'execve-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees...
Linus Torvalds [Fri, 20 Mar 2026 18:59:35 +0000 (11:59 -0700)] 
Merge tag 'execve-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull execve fixes from Kees Cook:

 - binfmt_elf_fdpic: fix AUXV size calculation (Andrei Vagin)

 - fs/tests: exec: Remove bad test vector

* tag 'execve-v7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  fs/tests: exec: Remove bad test vector
  binfmt_elf_fdpic: fix AUXV size calculation for ELF_HWCAP3 and ELF_HWCAP4

6 weeks agoPM: hibernate: return -ENODATA if the snapshot image is not loaded
Alberto Garcia [Mon, 9 Mar 2026 17:39:42 +0000 (18:39 +0100)] 
PM: hibernate: return -ENODATA if the snapshot image is not loaded

snapshot_image_loaded() is used in both the in-kernel and the
userspace restore path to ensure that the snapshot image has been
completely loaded. However the latter path returns -EPERM in such
situations, which is meant for cases where the operation is neither
write-only nor ready.

This patch updates the check so the returned error code is -ENODATA in
both cases.

Suggested-by: Brian Geffon <bgeffon@google.com>
Signed-off-by: Alberto Garcia <berto@igalia.com>
Acked-by: Brian Geffon <bgeffon@google.com>
Link: https://patch.msgid.link/8cfda38659c623f5392f3458cb32504ffd556a74.1773075892.git.berto@igalia.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
6 weeks agoMerge tag 'tty-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Linus Torvalds [Fri, 20 Mar 2026 18:52:32 +0000 (11:52 -0700)] 
Merge tag 'tty-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty/serial fixes from Greg KH:
 "Here are some small tty/vt and serial driver fixes for 7.0-rc5.
  Included in here are:

   - 8250 driver fixes for reported problems

   - serial core lockup fix

   - uartlite driver bugfix

   - vt save/restore bugfix

  All of these have been in linux-next for over a week with no reported
  problems"

* tag 'tty-7.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  vt: save/restore unicode screen buffer for alternate screen
  serial: 8250_dw: Ensure BUSY is deasserted
  serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
  serial: 8250_dw: Rework IIR_NO_INT handling to stop interrupt storm
  serial: 8250_dw: Rework dw8250_handle_irq() locking and IIR handling
  serial: 8250: Add serial8250_handle_irq_locked()
  serial: 8250_dw: Avoid unnecessary LCR writes
  serial: 8250: Protect LCR write in shutdown
  serial: 8250_pci: add support for the AX99100
  serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
  serial: uartlite: fix PM runtime usage count underflow on probe
  serial: 8250: always disable IRQ during THRE test
  serial: 8250: Fix TX deadlock when using DMA

6 weeks agoinit/Kconfig: Require a release version of clang-22 for CC_HAS_COUNTED_BY_PTR
Nathan Chancellor [Thu, 19 Mar 2026 00:20:18 +0000 (17:20 -0700)] 
init/Kconfig: Require a release version of clang-22 for CC_HAS_COUNTED_BY_PTR

Commit 150a04d817d8 ("compiler_types.h: Attributes: Add __counted_by_ptr
macro") used Clang 22.0.0 as a minimum supported version for
__counted_by_ptr, which made sense while 22.0.0 was the version of
LLVM's main branch to allow developers to easily test and develop uses
of __counted_by_ptr in their code. However, __counted_by_ptr requires a
change [1] merged towards the end of the 22 development cycle to avoid
errors when applied to void pointers.

  In file included from fs/xfs/xfs_attr_inactive.c:18:
  fs/xfs/libxfs/xfs_attr.h:59:2: error: 'counted_by' cannot be applied to a pointer with pointee of unknown size because 'void' is an incomplete type
     59 |         void                    *buffer __counted_by_ptr(bufsize);
        |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This is disruptive for deployed prerelease clang-22 builds (such as
Android LLVM) or when bisecting between llvmorg-21-init and the fix.

Require a released version of clang-22 (i.e., 21.1.0 or newer) to
enabled __counted_by_ptr to ensure all fixes needed for proper support
are present.

Fixes: 150a04d817d8 ("compiler_types.h: Attributes: Add __counted_by_ptr macro")
Link: https://github.com/llvm/llvm-project/commit/f29955a594aedf5943d492a999b83e8c6b8fafae
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260318-counted_by_ptr-release-clang-22-v1-1-e017da246df0@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
6 weeks agox86/platform/uv: Handle deconfigured sockets
Kyle Meyer [Fri, 20 Mar 2026 17:19:20 +0000 (12:19 -0500)] 
x86/platform/uv: Handle deconfigured sockets

When a socket is deconfigured, it's mapped to SOCK_EMPTY (0xffff). This causes
a panic while allocating UV hub info structures.

Fix this by using NUMA_NO_NODE, allowing UV hub info structures to be
allocated on valid nodes.

Fixes: 8a50c5851927 ("x86/platform/uv: UV support for sub-NUMA clustering")
Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Steve Wahl <steve.wahl@hpe.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/ab2BmGL0ehVkkjKk@hpe.com
6 weeks agodrm/xe: Fix format specifier for printing pointer differences
Nathan Chancellor [Mon, 16 Mar 2026 21:54:22 +0000 (14:54 -0700)] 
drm/xe: Fix format specifier for printing pointer differences

GCC and clang warn (or error with CONFIG_WERROR=y / W=e) several times
when targeting 32-bit platforms along the lines of

  drivers/gpu/drm/xe/xe_lrc.c: In function 'dump_mi_command':
  drivers/gpu/drm/xe/xe_lrc.c:1921:40: error: format '%lx' expects argument of type 'long unsigned int', but argument 3 has type 'int' [-Werror=format=]
   1921 |                 drm_printf(p, "LRC[%#5lx]  =  [%#010x] MI_NOOP (%d dwords)\n",
        |                                    ~~~~^
        |                                        |
        |                                        long unsigned int
        |                                    %#5x
   1922 |                            dw - num_noop - start, inst_header, num_noop);
        |                            ~~~~~~~~~~~~~~~~~~~~~
        |                                          |
        |                                          int

  drivers/gpu/drm/xe/xe_lrc.c:1922:7: error: format specifies type 'unsigned long' but the argument has type '__ptrdiff_t' (aka 'int') [-Werror,-Wformat]
   1921 |                 drm_printf(p, "LRC[%#5lx]  =  [%#010x] MI_NOOP (%d dwords)\n",
        |                                    ~~~~~
        |                                    %#5tx
   1922 |                            dw - num_noop - start, inst_header, num_noop);
        |                            ^~~~~~~~~~~~~~~~~~~~~

Use the '%tx' specifier for printing pointer differences, which clears
up the warnings for 32-bit platforms while introducing no regressions
for 64-bit platforms.

Fixes: 65fcf19cb36b ("drm/xe: Include running dword offset in default_lrc dumps")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patch.msgid.link/20260316-drm-xe-fix-32-bit-wformat-ptrdiff-v1-1-0108b10b2b6b@kernel.org
Signed-off-by: Matt Roper <matthew.d.roper@intel.com>