summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-30Merge tag 'nfsd-6.19-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: "A set of NFSD fixes that arrived just a bit late for the 6.19 merge window. Regression fix: - Avoid unnecessarily breaking a timestamp delegation Stable fixes: - Fix a crasher in nlm4svc_proc_test() - Fix nfsd_file reference leak during write delegation - Fix error flow in client_states_open()" * tag 'nfsd-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: nfsd: Drop the client reference in client_states_open() nfsd: use ATTR_DELEG in nfsd4_finalize_deleg_timestamps() nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() lockd: fix vfs_test_lock() calls
2025-12-30io_uring: use GFP_NOWAIT for overflow CQEs on legacy ringsAlexandre Negrel
Allocate the overflowing CQE with GFP_NOWAIT instead of GFP_ATOMIC. This changes causes allocations to fail earlier in out-of-memory situations, rather than being deferred. Using GFP_ATOMIC allows a process to exceed memory limits. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220794 Signed-off-by: Alexandre Negrel <alexandre@negrel.dev> Link: https://lore.kernel.org/io-uring/20251229201933.515797-1-alexandre@negrel.dev/ Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-30Merge branch 'bpf-calls-to-bpf_loop-should-have-an-scc-and-accumulate-backedges'Alexei Starovoitov
Eduard Zingerman says: ==================== bpf: calls to bpf_loop() should have an SCC and accumulate backedges This is a correctness fix for the verification of BPF programs that work with callback-calling functions. The problem is the same as the issue fixed by series [1] for iterator-based loops: some of the states created while processing the callback function body might have incomplete read or precision marks. An example of an unsafe program that is accepted without this fix can be found in patch #2. There is some impact on verification performance: File Program Insns (A) Insns (B) Insns (DIFF) ------------------------------- -------------------- --------- --------- ----------------- pyperf600_bpf_loop.bpf.o on_event 4247 9985 +5738 (+135.11%) setget_sockopt.bpf.o skops_sockopt 5719 7446 +1727 (+30.20%) setget_sockopt.bpf.o socket_post_create 1253 1603 +350 (+27.93%) strobemeta_bpf_loop.bpf.o on_event 3424 7224 +3800 (+110.98%) test_tcp_custom_syncookie.bpf.o tcp_custom_syncookie 11929 38307 +26378 (+221.12%) xdp_synproxy_kern.bpf.o syncookie_tc 13986 23035 +9049 (+64.70%) xdp_synproxy_kern.bpf.o syncookie_xdp 13881 21022 +7141 (+51.44%) Total progs: 4172 Old success: 2520 New success: 2520 total_insns diff min: 0.00% total_insns diff max: 221.12% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 837,487 total_insns abs max new: 837,487 0 .. 5 %: 4163 5 .. 15 %: 2 25 .. 35 %: 2 50 .. 60 %: 1 60 .. 70 %: 1 110 .. 120 %: 1 135 .. 145 %: 1 220 .. 225 %: 1 [1] https://lore.kernel.org/bpf/174968344350.3524559.14906547029551737094.git-patchwork-notify@kernel.org/ --- ==================== Link: https://patch.msgid.link/20251229-scc-for-callbacks-v1-0-ceadfe679900@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-12-30selftests/bpf: test cases for bpf_loop SCC and state graph backedgesEduard Zingerman
Test for state graph backedges accumulation for SCCs formed by bpf_loop(). Equivalent to the following C program: int main(void) { 1: fp[-8] = bpf_get_prandom_u32(); 2: fp[-16] = -32; // used in a memory access below 3: bpf_loop(7, loop_cb4, fp, 0); 4: return 0; } int loop_cb4(int i, void *ctx) { 5: if (unlikely(ctx[-8] > bpf_get_prandom_u32())) 6: *(u64 *)(fp + ctx[-16]) = 42; // aligned access expected 7: if (unlikely(fp[-8] > bpf_get_prandom_u32())) 8: ctx[-16] = -31; // makes said access unaligned 9: return 0; } If state graph backedges are not accumulated properly at the SCC formed by loop_cb4() call from bpf_loop(), the state {ctx[-16]=-32} injected at instruction 9 on verification path 1,2,3,5,7,9,4 would be considered fully verified and would lack precision mark for ctx[-16]. This would lead to early pruning of verification path 1,2,3,5,7,8,9 in state {ctx[-16]=-31}, which in turn leads to the incorrect assumption that the above program is safe. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20251229-scc-for-callbacks-v1-2-ceadfe679900@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-12-30bpf: bpf_scc_visit instance and backedges accumulation for bpf_loop()Eduard Zingerman
Calls like bpf_loop() or bpf_for_each_map_elem() introduce loops that are not explicitly present in the control-flow graph. The verifier processes such calls by repeatedly interpreting the callback function body within the same verification path (until the current state converges with a previous state). Such loops require a bpf_scc_visit instance in order to allow the accumulation of the state graph backedges. Otherwise, certain checkpoint states created within the bodies of such loops will have incomplete precision marks. See the next patch for an example of a program that leads to the verifier accepting an unsafe program. Fixes: 96c6aa4c63af ("bpf: compute SCCs in program control flow graph") Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges") Reported-by: Breno Leitao <leitao@debian.org> Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Tested-by: Breno Leitao <leitao@debian.org> Link: https://lore.kernel.org/r/20251229-scc-for-callbacks-v1-1-ceadfe679900@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-12-30rust: driver: fix broken intra-doc links to example driver typesAlice Ryhl
The `auxiliary` and `pci` modules are conditional on `CONFIG_AUXILIARY_BUS` and `CONFIG_PCI` respectively. When these are disabled, the intra-doc links to `auxiliary::Driver` and `pci::Driver` break, causing rustdoc warnings (or errors with `-D warnings`). error: unresolved link to `kernel::auxiliary::Driver` --> rust/kernel/driver.rs:82:28 | 82 | //! [`auxiliary::Driver`]: kernel::auxiliary::Driver | ^^^^^^^^^^^^^^^^^^^^^^^^^ no item named `auxiliary` in module `kernel` Fix this by making the documentation for these examples conditional on the corresponding configuration options. Fixes: 970a7c68788e ("driver: rust: expand documentation for driver infrastructure") Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reported-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Closes: https://lore.kernel.org/rust-for-linux/20251209.151817.744108529426448097.fujita.tomonori@gmail.com/ Link: https://patch.msgid.link/20251227-driver-types-v1-1-1916154fbe5e@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-30selftests/bpf: Fix verifier_arena_large/big_alloc3 testPuranjay Mohan
The big_alloc3() test tries to allocate 2051 pages at once in non-sleepable context and this can fail sporadically on resource contrained systems, so skip this test in case of such failures. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Link: https://lore.kernel.org/r/20251230195134.599463-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-12-30smack: /smack/doi: accept previously used valuesKonstantin Andreev
Writing to /smack/doi a value that has ever been written there in the past disables networking for non-ambient labels. E.g. # cat /smack/doi 3 # netlabelctl -p cipso list Configured CIPSO mappings (1) DOI value : 3 mapping type : PASS_THROUGH # netlabelctl -p map list Configured NetLabel domain mappings (3) domain: "_" (IPv4) protocol: UNLABELED domain: DEFAULT (IPv4) protocol: CIPSO, DOI = 3 domain: DEFAULT (IPv6) protocol: UNLABELED # cat /smack/ambient _ # cat /proc/$$/attr/smack/current _ # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.964 ms # echo foo >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.956 ms unknown option 86 # echo 4 >/smack/doi # echo 3 >/smack/doi !> [ 214.050395] smk_cipso_doi:691 cipso add rc = -17 # echo 3 >/smack/doi !> [ 249.402261] smk_cipso_doi:678 remove rc = -2 !> [ 249.402261] smk_cipso_doi:691 cipso add rc = -17 # ping -c1 10.1.95.12 !!> ping: 10.1.95.12: Address family for hostname not supported # echo _ >/proc/$$/attr/smack/current # ping -c1 10.1.95.12 64 bytes from 10.1.95.12: icmp_seq=1 ttl=64 time=0.617 ms This happens because Smack keeps decommissioned DOIs, fails to re-add them, and consequently refuses to add the “default” domain map: # netlabelctl -p cipso list Configured CIPSO mappings (2) DOI value : 3 mapping type : PASS_THROUGH DOI value : 4 mapping type : PASS_THROUGH # netlabelctl -p map list Configured NetLabel domain mappings (2) domain: "_" (IPv4) protocol: UNLABELED !> (no ipv4 map for default domain here) domain: DEFAULT (IPv6) protocol: UNLABELED Fix by clearing decommissioned DOI definitions and serializing concurrent DOI updates with a new lock. Also: - allow /smack/doi to live unconfigured, since adding a map (netlbl_cfg_cipsov4_map_add) may fail. CIPSO_V4_DOI_UNKNOWN(0) indicates the unconfigured DOI - add new DOI before removing the old default map, so the old map remains if the add fails (2008-02-04, Casey Schaufler) Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2025-12-30smack: /smack/doi must be > 0Konstantin Andreev
/smack/doi allows writing and keeping negative doi values. Correct values are 0 < doi <= (max 32-bit positive integer) (2008-02-04, Casey Schaufler) Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel") Signed-off-by: Konstantin Andreev <andreev@swemel.ru> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2025-12-30security: smack: fix indentation in smack_access.cTaimoor Zaeem
Replace spaces in code indent with tab character. Signed-off-by: Taimoor Zaeem <taimoorzaeem@gmail.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
2025-12-30kbuild: uapi: Drop check_config()Thomas Weißschuh
headers_install.sh already tests for CONFIG symbols. It does so in a more comprehensive way, by only checking for references in code and also running even if CONFIG_UAPI_HEADER_TEST is disabled. And check_config() has been disabled any case. Drop the pointless check. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Reviewed-by: Nicolas Schier <nsc@kernel.org> Link: https://patch.msgid.link/20251230-uapi-check_config-v1-1-00ecec109f39@linutronix.de Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2025-12-30drm/i915/utils: drop unnecessary ifdefsJani Nikula
The i915_utils.h and intel_display_utils.h were in some cases included from the same files, the former via i915_drv.h and the latter directly. This lead to a clash between MISSING_CASE() and fetch_and_zero() defined in both, requiring ifdefs. With the display dependency on i915_drv.h removed, we can also remove the now unnecessary ifdefs. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/f40a1fd365cbcfb77bd76ce0041c4523699f6052.1767009044.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-30drm/xe: remove compat i915_drv.h and -Ddrm_i915_private=xe_device hackJani Nikula
The xe display build no longer needs the compat i915_drv.h or the ugly -Ddrm_i915_private=xe_device hack. Remove them, with great pleasure. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/8d2da5404439ed334d7682922b599f36eeb60e9d.1767009044.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-30drm/i915: drop i915 param from i915_fence{, _context}_timeout()Jani Nikula
The i915_fence_context_timeout() and i915_fence_timeout() functions both have the struct drm_i915_private parameter, which is unused. It's likely in preparation for something that just didn't end up happening. Remove them, dropping the last struct drm_i915_private usage for xe display build. Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/dce86cb031d523a95a96ed2bf9c93bb28e6b20ab.1767009044.git.jani.nikula@intel.com Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-30scripts/gen-btf.sh: Fix .btf.o generation when compiling for RISCVIhor Solodrai
gen-btf.sh emits a .btf.o file with BTF sections to be linked into vmlinux in link-vmlinux.sh This .btf.o file is created by compiling an emptystring with ${CC}, and then adding BTF sections into it with ${OBJCOPY}. To ensure the .btf.o is linkable when cross-compiling with LLVM, we have to also pass ${KBUILD_FLAGS}, which in particular control the target word size. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202512240559.2M06DSX7-lkp@intel.com/ Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/r/20251229202823.569619-1-ihor.solodrai@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-12-30PCI: qcom: Parse PERST# from all PCIe bridge nodesManivannan Sadhasivam
Devicetree schema allows the PERST# GPIO to be present in all PCIe bridge nodes, not just in Root Port node. But the current logic parses PERST# only from the Root Port nodes. Though it is not causing any issue on the current platforms, the upcoming platforms will have PERST# in PCIe switch downstream ports also. So this requires parsing all the PCIe bridge nodes for the PERST# GPIO. Hence, rework the parsing logic to extend to all PCIe bridge nodes starting from the Root Port node. If the 'reset-gpios' property is found for a PCI bridge node, the GPIO descriptor will be stored in qcom_pcie_perst::desc and added to the qcom_pcie_port::perst list. It should be noted that if more than one bridge node has the same GPIO for PERST# (shared PERST#), the driver will error out. This is due to the limitation in the GPIOLIB subsystem that allows only exclusive (non-shared) access to GPIOs from consumers. But this is soon going to get fixed. Once that happens, it will get incorporated in this driver. So for now, PERST# sharing is not supported. Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20251216-pci-pwrctrl-rework-v2-1-745a563b9be6@oss.qualcomm.com
2025-12-30PCI: qcom: Remove ASPM L0s support for MSM8996 SoCManivannan Sadhasivam
Though I couldn't confirm ASPM L0s support with the Qcom hardware team, a bug report from Dmitry suggests that L0s is broken on this legacy SoC. Hence, remove L0s support from the Root Port Link Capabilities in this SoC. Since qcom_pcie_clear_aspm_l0s() is now used by more than one SoC config, call it from qcom_pcie_host_init() instead. Reported-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Closes: https://lore.kernel.org/linux-pci/4cp5pzmlkkht2ni7us6p3edidnk25l45xrp6w3fxguqcvhq2id@wjqqrdpkypkf Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Tested-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://patch.msgid.link/20251126081718.8239-1-mani@kernel.org
2025-12-30PCI: rzg3s-host: Drop the lock on RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVISClaudiu Beznea
The RZG3S_PCI_MSIRS and RZG3S_PCI_PINTRCVIS registers are of the R/W1C type. According to the RZ/G3S HW Manual, Rev. 1.10, chapter 34.2.1 Register Type, R/W1C register bits are cleared to 0b by writing 1b, while writing 0b has no effect. Therefore, there is no need to take a lock around writes to these registers. Drop the locking. Along with this, add a note about the R/W1C register type to the register offset definitions. Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20251217111510.138848-3-claudiu.beznea.uj@bp.renesas.com
2025-12-30PCI: rzg3s-host: Use pci_generic_config_write() for the root busClaudiu Beznea
The Renesas RZ/G3S host controller allows writing to read-only PCIe configuration registers when the RZG3S_PCI_PERM_CFG_HWINIT_EN bit is set in the RZG3S_PCI_PERM register. However, callers of struct pci_ops::write expect the semantics defined by the PCIe specification, meaning that writes to read-only registers must not be allowed. The previous custom struct pci_ops::write implementation for the root bus temporarily enabled write access before calling pci_generic_config_write(). This breaks the expected semantics. Remove the custom implementation and simply use pci_generic_config_write(). Along with this change, the updates of the PCI_PRIMARY_BUS, PCI_SECONDARY_BUS, and PCI_SUBORDINATE_BUS registers were moved so that they no longer depends on the RZG3S_PCI_PERM_CFG_HWINIT_EN bit in the RZG3S_PCI_PERM_CFG register, since these registers are R/W. Fixes: 7ef502fb35b2 ("PCI: Add Renesas RZ/G3S host controller driver") Suggested-by: Bjorn Helgaas <helgaas@kernel.org> Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Link: https://patch.msgid.link/20251217111510.138848-2-claudiu.beznea.uj@bp.renesas.com
2025-12-30dt-bindings: PCI: socionext,uniphier-pcie: Fix interrupt controller node nameRob Herring (Arm)
The child node name in use by .dts files and the driver is "legacy-interrupt-controller", not "interrupt-controller". Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com> Link: https://patch.msgid.link/20251215212456.3317558-1-robh@kernel.org
2025-12-30Merge tag 'net-6.19-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth and WiFi. Notably this includes the fix for the iwlwifi issue you reported. Current release - regressions: - core: avoid prefetching NULL pointers - wifi: - iwlwifi: implement settime64 as stub for MVM/MLD PTP - mac80211: fix list iteration in ieee80211_add_virtual_monitor() - handshake: fix null-ptr-deref in handshake_complete() - eth: mana: fix use-after-free in reset service rescan path Previous releases - regressions: - openvswitch: avoid needlessly taking the RTNL on vport destroy - dsa: properly keep track of conduit reference - ipv4: - fix error route reference count leak with nexthop objects - fib: restore ECMP balance from loopback - mptcp: ensure context reset on disconnect() - bluetooth: fix potential UaF in btusb - nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write - eth: - gve: defer interrupt enabling until NAPI registration - i40e: fix scheduling in set_rx_mode - macb: relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() - rtl8150: fix memory leak on usb_submit_urb() failure - wifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() Previous releases - always broken: - ip6_gre: make ip6gre_header() robust - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT - af_unix: don't post cmsg for SO_INQ unless explicitly asked for - phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration - wifi: mac80211: discard beacon frames to non-broadcast address - eth: - iavf: fix off-by-one issues in iavf_config_rss_reg() - stmmac: fix the crash issue for zero copy XDP_TX action - team: fix check for port enabled when priority changes" * tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits) ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT net: rose: fix invalid array index in rose_kill_by_device() net: enetc: do not print error log if addr is 0 net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open() selftests: fib_test: Add test case for ipv4 multi nexthops net: fib: restore ECMP balance from loopback selftests: fib_nexthops: Add test cases for error routes deletion ipv4: Fix reference count leak when using error routes with nexthop objects net: usb: sr9700: fix incorrect command used to write single register ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() usbnet: avoid a possible crash in dql_completed() gve: defer interrupt enabling until NAPI registration net: stmmac: fix the crash issue for zero copy XDP_TX action octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" af_unix: don't post cmsg for SO_INQ unless explicitly asked for net: mana: Fix use-after-free in reset service rescan path net: avoid prefetching NULL pointers net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write net: usb: asix: validate PHY address before use ...
2025-12-30EDAC/amd64: Avoid a -Wformat-security warningArnd Bergmann
Using a variable as a format string causes a (default-disabled) warning: drivers/edac/amd64_edac.c: In function 'per_family_init': drivers/edac/amd64_edac.c:3914:17: error: format not a string literal and no format arguments [-Werror=format-security] 3914 | scnprintf(pvt->ctl_name, sizeof(pvt->ctl_name), tmp_name); | ^~~~~~~~~ The code here is safe, but in order to enable the warning by default in the future, change this instance to pass the name indirectly. Fixes: e9abd990aefd ("EDAC/amd64: Generate ctl_name string at runtime") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Avadhut Naik <avadhut.naik@amd.com> Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com> Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com> Link: https://patch.msgid.link/20251204100231.1034557-1-arnd@kernel.org
2025-12-30drm/mediatek: Move DP training to hotplug threadLiankun Yang
By adjusting the order of link training and relocating it to HPD, link training can identify the usability of each lane in the current link. It also supports handling signal instability and weakness due to environmental issues, enabling the acquisition of a stable bandwidth for the current link. Subsequently, DP work can proceed based on the actual maximum bandwidth. It should training in the hpd event thread. Check the mode with lane count and link rate of training. If we're eDP and capabilities were already parsed we can skip reading again because eDP panels aren't hotpluggable hence the caps and training information won't ever change in a boot life Therefore, bridge typec judgment is required for edp training in atomic_enable function. `mtk_dp_parse_capabilities` is related to DP training, it is used in `mtk_dp_hpd_event_thread` before DP training, and then only used by eDP when read edid. -Modify part of in `mtk_dp_bridge_atomic_disable` if (mtk_dp->train_info.cable_plugged_in) { drm_dp_dpcd_writeb(&mtk_dp->aux, DP_SET_POWER, DP_SET_POWER_D3); usleep_range(2000, 3000); } /* power off aux */ mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE, DP_PWR_STATE_BANDGAP_TPLL, DP_PWR_STATE_MASK); -Modify part of in `mtk_dp_aux_panel_poweron(mtk_dp, false);` if (pwron) { .... } else { /* power off panel */ drm_dp_dpcd_writeb(&mtk_dp->aux, DP_SET_POWER, DP_SET_POWER_D3); usleep_range(2000, 3000); /* power off aux */ mtk_dp_update_bits(mtk_dp, MTK_DP_TOP_PWR_STATE, DP_PWR_STATE_BANDGAP_TPLL, DP_PWR_STATE_MASK); } The `mtk_dp_aux_panel_poweron` function fails to align. Within the `mtk_dp_hpd_event_thread`, if DP is disconnected, the `mtk_dp_aux_panel_poweron` function will write from `aux` to `DPRX`, causing a failure and thus preventing symmetry. This shows the current timings after the DP cable is plugged in, as well as the modified timings. current timings: Fix timings: mtk_dp_hpd_event_thread() mtk_dp_hpd_event_thread() (including DP link training) | | ... ... mtk_dp_bridge_mode_valid() mtk_dp_bridge_mode_valid() | ... ... mtk_dp_bridge_atomic_check() mtk_dp_bridge_atomic_check() | ... ... mtk_dp_bridge_atomic_enable() mtk_dp_bridge_atomic_enable() (including DP link training) PS: 1. "..." represents ommited steps; 2. `mtk_dp_bridge_mode_valid()` calculates the bandwidth using the current lane count and link rate, and then filters each mode to determine if it supports returning a status. 3. In the `drm_display_mode_to_videomode(&crtc_state->adjusted_mode, &mtk_dp->info.vm);` function, within the `mtk_dp_bridge_atomic_check()` function, `adjusted_mode` sets the currently selected display mode for the DRM. 4. DP link training tests the signal conditions of the link between DPTX and DPRX, and selects the lane count and link rate that meet the signal conditions. 5. For example, the platform support DP 4lane 5.4G, but panel A support DP 2lane 5.4G. This is a time sequence: a).Plug in panel A. According to the platform, it can output 4K60Hz. b).Timing mode set 4K 60Hz(Including in mtk_dp_bridge_atomic_check function). c).Atomic enable(Based on panel A ability, training pass 2lane 5.4G). d).Finally, due to 2lane 5.4G bandwidth limitation, the platform cannot output 4K 60Hz, resulting in a black sreen. If apply this patch. a).Plug in panel A. b).Training pass 2lane 5.4G c).Timing mode set 2K 60Hz(Based on the 2lane 5.4G bandwidth limit and including in mtk_dp_bridge_atomic_che Signed-off-by: Liankun Yang <liankun.yang@mediatek.com> Link: https://patchwork.kernel.org/project/dri-devel/patch/20251223061755.7717-1-liankun.yang@mediatek.com/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30blk-mq: skip CPU offline notify on unmapped hctxCong Zhang
If an hctx has no software ctx mapped, blk_mq_map_swqueue() never allocates tags and leaves hctx->tags NULL. The CPU hotplug offline notifier can still run for that hctx, return early since hctx cannot hold any requests. Signed-off-by: Cong Zhang <cong.zhang@oss.qualcomm.com> Fixes: bf0beec0607d ("blk-mq: drain I/O when all CPUs in a hctx are offline") Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-30drm/mediatek: mtk_hdmi_ddc_v2: Fix multi-byte writesLouis-Alexis Eyraud
Currently, the mtk_hdmi_ddc_v2 driver sends a i2c message by calling the mtk_ddc_wr_one function for each byte of the payload to setup SI2C_CTRL and DDC_CTRL registers, and perform a sequential write transfer of one byte at a time to the target device. This leads to incorrect transfers as the target address (at least) is also sent each time. So, rename mtk_ddc_wr_one function to mtk_ddcm_write_hdmi to match the read function name (mtk_ddcm_read_hdmi) and modify its behaviour to send all payload data in a single sequential write transfer by filling the transfer fifo first then starting the transfer with a size equal to the payload size and not one anymore. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://patchwork.kernel.org/project/dri-devel/patch/20251205-mtk-hdmi-ddc-v2-fixes-v1-2-260dd0d320f4@collabora.com/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30drm/mediatek: mtk_hdmi_ddc_v2: Add transfer abort on timeout casesLouis-Alexis Eyraud
During a read or write transfer, the mtk_hdmi_ddc_v2 driver polls the DDC_I2C_IN_PROG bit of HPD_DDC_STATUS register to check if the transfer completes but do no particular action if a timeout is reached. It could lead the next transfer attempts to fail because the faulty transfer was not aborted. So, add in both low level read and write functions a abort action by writing the DDC_CTRL register with the ABORT_XFER command value. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com> Link: https://patchwork.kernel.org/project/dri-devel/patch/20251205-mtk-hdmi-ddc-v2-fixes-v1-1-260dd0d320f4@collabora.com/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30drm/mediatek: mtk_hdmi_v2: Fix return type of mtk_hdmi_v2_tmds_char_rate_valid()Nathan Chancellor
When building with -Wincompatible-function-pointer-types-strict, a warning designed to catch kernel control flow integrity (kCFI) issues at build time, there is an instance in the new HDMI v2 drm/mediatek code: drivers/gpu/drm/mediatek/mtk_hdmi_v2.c:1331:31: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(const struct drm_bridge *, const struct drm_display_mode *, unsigned long long)' with an expression of type 'int (const struct drm_bridge *, const struct drm_display_mode *, unsigned long long)' [-Werror,-Wincompatible-function-pointer-types-strict] 1331 | .hdmi_tmds_char_rate_valid = mtk_hdmi_v2_hdmi_tmds_char_rate_valid, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ While 'int' and 'enum drm_mode_status' are ABI compatible, hence no regular warning from -Wincompatible-function-pointer-types, the mismatch will trigger a kCFI violation when mtk_hdmi_v2_tmds_char_rate_valid() is called indirectly. Update the return type of mtk_hdmi_v2_tmds_char_rate_valid() to be 'enum drm_mode_status' to clear up the warning and kCFI violation. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://patchwork.kernel.org/project/dri-devel/patch/20251125-drm-mediatek-hdmi-v2-wifpts-v1-1-a6c7582cf69a@kernel.org/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30drm/mediatek: Fix platform_get_irq() error checkingDan Carpenter
The platform_get_irq() function returns negative error codes on failure and positive non-zero IRQ numbers on success. It never returns NULL. Fix the error checking to look for negatives, and change "hdmi->irq" from unsigned int to just int. Fixes: 8d0f79886273 ("drm/mediatek: Introduce HDMI/DDC v2 for MT8195/MT8188") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> https://patchwork.kernel.org/project/dri-devel/patch/aSW0p5sqnJVJsqDO@stanley.mountain/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 modeShawn Lin
When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes. Add a check to prevent illegal clock reduction through debugfs: root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ... Fixes: c6f361cba51c ("mmc: sdhci-of-dwcmshc: add support for rk3588") Cc: Sebastian Reichel <sebastian.reichel@collabora.com> Cc: Yifeng Zhao <yifeng.zhao@rock-chips.com> Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2025-12-30drm/mediatek: mtk_hdmi_v2: Remove unneeded semicolonChen Ni
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Link: https://patchwork.kernel.org/project/dri-devel/patch/20251125014740.1059347-1-nichen@iscas.ac.cn/ Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-12-30smb: client: fix UBSAN array-index-out-of-bounds in smb2_copychunk_rangeHenrique Carvalho
struct copychunk_ioctl_req::ChunkCount is annotated with __counted_by_le() as the number of elements in Chunks[]. smb2_copychunk_range reuses ChunkCount to store the number of chunks sent in the current iteration. If a later iteration populates more chunks than a previous one, the stale smaller value trips UBSAN. Set ChunkCount to chunk_count (allocated capacity) before populating Chunks[]. Fixes: cc26f593dc19 ("smb: move copychunk definitions to common/smb2pdu.h") Link: https://lore.kernel.org/linux-cifs/CAH2r5ms9AWLy8WZ04Cpq5XOeVK64tcrUQ6__iMW+yk1VPzo1BA@mail.gmail.com Tested-by: Youling Tang <tangyouling@kylinos.cn> Acked-by: ChenXiaoSong <chenxiaosong@kylinos.cn> Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-30smb3 client: add missing tracepoint for unsupported ioctlsSteve French
In debugging a recent problem with an xfstest, noticed that we weren't tracing cases where the ioctl was not supported. Add dynamic tracepoint: "trace-cmd record -e smb3_unsupported_ioctl" and then after running an app which calls unsupported ioctl, "trace-cmd show"would display e.g. xfs_io-7289 [012] ..... 1205.137765: smb3_unsupported_ioctl: xid=19 fid=0x4535bb84 ioctl cmd=0x801c581f Acked-by: Bharath SM <bharathsm@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-12-30ARM: dts: microchip: lan966x: Fix the access to the PHYs for pcb8290Horatiu Vultur
The problem is that the MDIO controller can't detect any of the PHYs. The reason is that the lan966x is not pulling high the GPIO 53 that is connected to the PHYs reset GPIO. Without doing this the PHYs are kept in reset. The mdio controller framework has the possibility to control a GPIO to release the reset of the PHYs. So take advantage of this and set line to be high before accessing the PHYs. Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com> Reviewed-by: Claudiu Beznea <claudiu.beznea@tuxon.dev> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20251119134750.394655-1-horatiu.vultur@microchip.com [claudiu.beznea: add microchip in patch title, s/possiblity/possibility in patch description] Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
2025-12-30ARM: dts: imx: imx6sl: fix lcdif compatibleAndreas Kemnade
Fix lcdif compatible according to bindings doc. dtbs_check tested only, a glance at the datasheet shows that it should be the correct fallback compatible. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30ARM: imx_v6_v7_defconfig: enable EPD regulator needed for Kobo Clara 2eAndreas Kemnade
Kobo Clara 2e revision b requires the JD9930/FP9931 regulator driver for the EPD, so enable it. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30ARM: dts: imx: imx6sll-kobo-clara2e: add regulator for EPDAndreas Kemnade
Now there is a driver and binding for the JD9930, so add the information to the devicetree for revision b. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30ARM: dts: imx: imx6sll: fix lcdif compatibleAndreas Kemnade
Fix lcdif compatible according to bindings doc. dtbs_check tested only, a glance at the datasheet shows that it should be the correct fallback compatible. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30dt-bindings: arm: fsl: Add Apalis iMX8QPFrancesco Dolcini
Add binding documentation for the Apalis iMX8QP SoM mated with Apalis Ixora and Apalis Evaluation board. Apalis iMX8QP is a variant of the Apalis iMX8QM, using an NXP i.MX8QP SoC instead of the i.MX8QM. The two SoCs are pin to pin compatible, with the i.MX8QP being a lower end variant, with a slower GPU and one Cortex A72 core instead of two. The two Apalis SoMs variants share the same schematics and PCB, and the iMX8QP variant exists only on revision V1.1 of board. Link: https://www.nxp.com/products/i.MX8 Link: https://www.toradex.com/computer-on-modules/apalis-arm-family/nxp-imx-8 Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Add Apalis iMX8QPFrancesco Dolcini
Add support for the Apalis iMX8QP SoM mated with Apalis Ixora and Apalis Evaluation board. Apalis iMX8QP is a variant of the Apalis iMX8QM, using an NXP i.MX8QP SoC instead of the i.MX8QM. The two SoCs are pin to pin compatible, with the i.MX8QP being a lower end variant, with a slower GPU and one Cortex A72 core instead of two. The two Apalis SoMs variants share the same schematics and PCB, and the iMX8QP variant exists only on revision V1.1 of board. Link: https://www.nxp.com/products/i.MX8 Link: https://www.toradex.com/computer-on-modules/apalis-arm-family/nxp-imx-8 Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Add NXP i.MX8QP SoC dtsiFrancesco Dolcini
Add support for NXP i.MX8QP SoC, this is pin to pin compatible variant of the i.MX8QM, with a slower GPU and one Cortex A72 core instead of two. Link: https://www.nxp.com/products/i.MX8 Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: imx8qm: Add CPU cluster labelsFrancesco Dolcini
Add labels to the cpu cluster nodes to prepare for the addition of the i.MX8QP SoC in which these nodes would need to be adjusted from another DT file. Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Use lowercase hexKrzysztof Kozlowski
The DTS code coding style expects lowercase hex for values and unit addresses. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Minor whitespace cleanupKrzysztof Kozlowski
The DTS code coding style expects exactly one space around '=' and before '{' characters. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Use hyphen in node namesKrzysztof Kozlowski
DTS coding style prefers hyphens instead of underscores in the node names. Change should be safe, because node names are not considered an ABI. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: imx94: add mt35xu512aba spi nor supportHaibo Chen
Add mt35xu512aba spi nor support on imx943-evk board. This nor chip support OCT DTR mode. For the reset pin, since the nor chip side need 1.8v IO voltage for reset pin, but the IO expander side use 3.3v IO voltage, so to make circuit safe, need to config the pad as OPEN DRAIN. Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: imx94: add xspi device nodeHaibo Chen
imx94 has two xspi, add these device nodes. Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Add i.MX952 EVK basic device treePeng Fan
Add i.MX952 EVK basic device tree, with UART1, SDHC[1,2] supported. Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30arm64: dts: freescale: Add initial device tree for i.MX952Peng Fan
i.MX952 is designed for AI-powered sensor fusion and vision sensing applications, it features 4 Corte-A55, 1 Cortex-M33, 1 Cortex-M7 and NXP eIQ NPU and advanced graphics, video and advanced security with edgelock. Product info could be found at: https://www.nxp.com/products/i.MX-952 The basic device tree includes: - clock, pin, power header files - device nodes: CPU[0-3], SCMI firmware, Interrupt Controller, Sys counter, eDMA, MU, SPI, UART, I2C, USB and etc Signed-off-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30dt-bindings: arm: fsl: add i.MX952 EVK boardPeng Fan
Add DT compatible string for NXP i.MX952 EVK board. Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-30RDMA/bnxt_re: fix dma_free_coherent() pointerThomas Fourier
The dma_alloc_coherent() allocates a dma-mapped buffer, pbl->pg_arr[i]. The dma_free_coherent() should pass the same buffer to dma_free_coherent() and not page-aligned. Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com> Link: https://patch.msgid.link/20251230085121.8023-2-fourier.thomas@gmail.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
generated by cgit v1.3 (git 2.53.0) at 2026-10-06 03:04:43 +0000