summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-02-05dpll: Allow associating dpll pin with a firmware nodeIvan Vecera
Extend the DPLL core to support associating a DPLL pin with a firmware node. This association is required to allow other subsystems (such as network drivers) to locate and request specific DPLL pins defined in the Device Tree or ACPI. * Add a .fwnode field to the struct dpll_pin * Introduce dpll_pin_fwnode_set() helper to allow the provider driver to associate a pin with a fwnode after the pin has been allocated * Introduce fwnode_dpll_pin_find() helper to allow consumers to search for a registered DPLL pin using its associated fwnode handle * Ensure the fwnode reference is properly released in dpll_pin_put() Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Signed-off-by: Ivan Vecera <ivecera@redhat.com> Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> Link: https://patch.msgid.link/20260203174002.705176-2-ivecera@redhat.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05tracing: Fix ftrace event field alignmentsSteven Rostedt
The fields of ftrace specific events (events used to save ftrace internal events like function traces and trace_printk) are generated similarly to how normal trace event fields are generated. That is, the fields are added to a trace_events_fields array that saves the name, offset, size, alignment and signness of the field. It is used to produce the output in the format file in tracefs so that tooling knows how to parse the binary data of the trace events. The issue is that some of the ftrace event structures are packed. The function graph exit event structures are one of them. The 64 bit calltime and rettime fields end up 4 byte aligned, but the algorithm to show to userspace shows them as 8 byte aligned. The macros that create the ftrace events has one for embedded structure fields. There's two macros for theses fields: __field_desc() and __field_packed() The difference of the latter macro is that it treats the field as packed. Rename that field to __field_desc_packed() and create replace the __field_packed() to be a normal field that is packed and have the calltime and rettime use those. This showed up on 32bit architectures for function graph time fields. It had: ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format [..] field:unsigned long func; offset:8; size:4; signed:0; field:unsigned int depth; offset:12; size:4; signed:0; field:unsigned int overrun; offset:16; size:4; signed:0; field:unsigned long long calltime; offset:24; size:8; signed:0; field:unsigned long long rettime; offset:32; size:8; signed:0; Notice that overrun is at offset 16 with size 4, where in the structure calltime is at offset 20 (16 + 4), but it shows the offset at 24. That's because it used the alignment of unsigned long long when used as a declaration and not as a member of a structure where it would be aligned by word size (in this case 4). By using the proper structure alignment, the format has it at the correct offset: ~# cat /sys/kernel/tracing/events/ftrace/funcgraph_exit/format [..] field:unsigned long func; offset:8; size:4; signed:0; field:unsigned int depth; offset:12; size:4; signed:0; field:unsigned int overrun; offset:16; size:4; signed:0; field:unsigned long long calltime; offset:20; size:8; signed:0; field:unsigned long long rettime; offset:28; size:8; signed:0; Cc: stable@vger.kernel.org Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Mark Rutland <mark.rutland@arm.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reported-by: "jempty.liang" <imntjempty@163.com> Link: https://patch.msgid.link/20260204113628.53faec78@gandalf.local.home Fixes: 04ae87a52074e ("ftrace: Rework event_create_dir()") Closes: https://lore.kernel.org/all/20260130015740.212343-1-imntjempty@163.com/ Closes: https://lore.kernel.org/all/20260202123342.2544795-1-imntjempty@163.com/ Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-02-05net/mlx5: Support devlink port state for host PFMoshe Shemesh
Add support for devlink port function state get/set operations for the host physical function (PF). Until now, mlx5 only allowed state get/set for subfunctions (SFs) ports. This change enables an administrator with eSwitch manager privileges to query or modify the host PF’s function state, allowing it to be explicitly inactivated or activated. While inactivated, the administrator can modify the functions attributes, such as enable/disable roce. $ devlink port show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: type eth netdev eth1 flavour pcipf controller 1 pfnum 0 external true splittable false function: hw_addr a0:88:c2:45:17:7c state active opstate attached roce enable max_io_eqs 120 $ devlink port function set pci/0000:03:00.0/196608 state inactive $ devlink port show pci/0000:03:00.0/196608 pci/0000:03:00.0/196608: type eth netdev eth1 flavour pcipf controller 1 pfnum 0 external true splittable false function: hw_addr a0:88:c2:45:17:7c state inactive opstate detached roce enable max_io_eqs 120 Signed-off-by: Moshe Shemesh <moshe@nvidia.com> Reviewed-by: Mark Bloch <mbloch@nvidia.com> Reviewed-by: Parav Pandit <parav@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260203102402.1712218-1-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05Merge branch 'acpi-apei'Rafael J. Wysocki
Merge ACPI APEI support updates for 6.20-rc1/7.0-rc1: - Make read-only array non_mmio_desc[] static const (Colin Ian King) - Prevent the APEI GHES support code on ARM from accessing memory out of bounds or going past the ARM processor CPER record buffer (Mauro Carvalho Chehab) - Prevent cper_print_fw_err() from dumping the entire memory on systems with defective firmware (Mauro Carvalho Chehab) - Improve ghes_notify_nmi() status check to avoid unnecessary overhead in the NMI handler by carrying out all of the requisite preparations and the NMI registration time (Tony Luck) - Refactor the GHES driver by extracting common functionality into reusable helper functions to reduce code duplication and improve the ghes_notify_sea() status check in analogy with the previous ghes_notify_nmi() status check improvement (Shuai Xue) - Make ELOG and GHES log and trace consistently and support the CPER CXL protocol analogously (Fabio De Francesco) - Disable KASAN instrumentation in the APEI GHES driver when compile testing with clang < 18 (Nathan Chancellor) - Let ghes_edac be the preferred driver to load on __ZX__ and _BYO_ systems by extending the platform detection list in the APEI GHES driver (Tony W Wang-oc) * acpi-apei: ACPI: APEI: GHES: Add ghes_edac support for __ZX__ and _BYO_ systems ACPI: APEI: GHES: Disable KASAN instrumentation when compile testing with clang < 18 ACPI: extlog: Trace CPER CXL Protocol Error Section ACPI: APEI: GHES: Add helper to copy CPER CXL protocol error info to work struct ACPI: APEI: GHES: Add helper for CPER CXL protocol errors checks ACPI: extlog: Trace CPER PCI Express Error Section ACPI: extlog: Trace CPER Non-standard Section Body ACPI: APEI: GHES: Improve ghes_notify_sea() status check ACPI: APEI: GHES: Extract helper functions for error status handling ACPI: APEI: GHES: Improve ghes_notify_nmi() status check EFI/CPER: don't dump the entire memory region APEI/GHES: ensure that won't go past CPER allocated record EFI/CPER: don't go past the ARM processor CPER record buffer APEI/GHES: ARM processor Error: don't go past allocated memory ACPI: APEI: EINJ: make read-only array non_mmio_desc static const
2026-02-05Merge branch 'acpi-processor'Rafael J. Wysocki
Merge ACPI processor driver changes for 6.20-rc1/7.0-rc1: - Rework the ACPI idle driver initialization to register it directly from the common initialization code instead of doing that from a CPU hotplug "online" callback and clean it up (Huisong Li, Rafael Wysocki) - Fix a possible NULL pointer dereference in acpi_processor_errata_piix4() (Tuo Li) * acpi-processor: ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void ACPI: processor: idle: Add debug log for states with invalid entry methods ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: idle: Optimize ACPI idle driver registration
2026-02-05Merge branches 'acpi-battery' and 'acpi-misc'Rafael J. Wysocki
Merge ACPI battery driver changes and a generic ACPI watchdog device driver change for 6.20-rc1/7.0-rc1: - Convert the generic ACPI battery driver to a proper platform driver using struct platform_driver for device binding (Rafael Wysocki) - Fix incorrect charging status when current is zero in the generic ACPI battery driver (Ata İlhan Köktürk) - Use LIST_HEAD() for initializing a stack-allocated list in the generic ACPI watchdog device driver (Can Peng) * acpi-battery: ACPI: battery: fix incorrect charging status when current is zero ACPI: battery: Convert the driver to a platform one ACPI: battery: Reduce code duplication related to cleanup ACPI: battery: Adjust event notification routine * acpi-misc: ACPI: acpi_watchdog: use LIST_HEAD for stack-allocated list
2026-02-05blk-mq: ABI/sysfs-block: fix docs build warningsRandy Dunlap
Clean up the async_depth documentation: - insert blank lines before and after lists where needed - convert verb tense in a few places - make lines fit within 80 characters Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Documentation/ABI/stable/sysfs-block:612: ERROR: Unexpected indentation. [docutils] Fixes: 2c04718edcd5 ("blk-mq: add documentation for new queue attribute async_dpeth") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-05Merge branch 'acpi-driver'Rafael J. Wysocki
Merge updates of drivers handling devices defined in the ACPI specification and other generic devices with ACPI interfaces for 6.20-rc1/7.0-rc1: - Add a piece of documentation explaining why binding drivers directly to ACPI device objects is not a good idea in general and why it is desirable to convert drivers doing so into proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Convert multiple "core ACPI" drivers, including the NFIT ACPI device driver, the generic ACPI button drivers, the generic ACPI thermal zone driver, the ACPI hardware event device (HED) driver, the ACPI EC driver, the ACPI SMBUS HC driver, the ACPI Smart Battery Subsystem (SBS) driver, and the ACPI backlight (video) driver to proper platform drivers that use struct platform_driver for device binding (Rafael Wysocki) - Use acpi_get_local_u64_address() in the ACPI backlight (video) driver to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) * acpi-driver: (25 commits) ACPI: video: simplify code with acpi_get_local_u64_address() ACPI: scan: Clean up after recent changes ACPI: scan: Use acpi_setup_gpe_for_wake() for buttons ACPI: PM: Let acpi_dev_pm_attach() skip devices without ACPI PM ACPI: Documentation: driver-api: Disapprove of using ACPI drivers ACPI: video: Convert the driver to a platform one ACPI: video: Adjust event notification routine ACPI: scan: Register platform devices for backlight device objects ACPI: SBS: Convert the driver to a platform one ACPI: SMBUS HC: Convert the driver to a platform one ACPI: EC: Convert the driver to a platform one ACPI: EC: Register a platform device for ECDT EC ACPI: HED: Convert the driver to a platform one ACPI: thermal: Rework system suspend and resume handling ACPI: thermal: Convert the driver to a platform one ACPI: thermal: Adjust event notification routine ACPI: scan: Register platform devices for thermal zones ACPI: scan: Do not mark button ACPI devices as wakeup-capable ACPI: scan: Do not bind ACPI drivers to fixed event buttons ACPI: tiny-power-button: Convert the driver to a platform one ...
2026-02-05bootconfig: Check the parsed output of the good examplesMasami Hiramatsu (Google)
Check whether the parsed output of the good example configs are the same as expected. Link: https://lore.kernel.org/all/177025239529.14982.12913754615993262263.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Tested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2026-02-05bootconfig: Terminate value search if it hits a newlineMasami Hiramatsu (Google)
Terminate the value search for a key if it hits a newline and make the value empty. When we pass a bootconfig with an empty value terminated by the newline, like below:: foo = bar = value Current bootconfig interprets it as a single entry:: foo = "bar = value"; The Documentation/admin-guide/bootconfig.rst defines the value itself is terminated by newline: The value has to be terminated by semi-colon (``;``) or newline (``\n``). but it does not define when the value search is terminated. This changes the behavior to be more line-oriented, so that it is clearer in how it works. - The value search of key-value pair will be terminated by a comment or newline. - The value search of an array will continue beyond comments and newlines. Thus, with this update, the above example is interpreted as:: foo = ""; bar = "value"; And the below example will cause a syntax error because "bar" is expected as a key but it has ','. foo = bar, buz According to this change, one wrong example config is updated. Link: https://lore.kernel.org/all/177025238503.14982.17059549076175612447.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
2026-02-05drm/xe/pm: Disable D3Cold for BMG only on specific platformsKarthik Poosa
Restrict D3Cold disablement for BMG to unsupported NUC platforms, instead of disabling it on all platforms. Signed-off-by: Karthik Poosa <karthik.poosa@intel.com> Fixes: 3e331a6715ee ("drm/xe/pm: Temporarily disable D3Cold on BMG") Link: https://patch.msgid.link/20260123173238.1642383-1-karthik.poosa@intel.com Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com> Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com> (cherry picked from commit 39125eaf8863ab09d70c4b493f58639b08d5a897) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe: Fix kerneldoc for xe_tlb_inval_job_alloc_depShuicheng Lin
Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval_job.c:210 expecting prototype for xe_tlb_inval_alloc_dep(). Prototype was for xe_tlb_inval_job_alloc_dep() instead" Fixes: 15366239e2130 ("drm/xe: Decouple TLB invalidations from GT") Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260129233834.419977-8-shuicheng.lin@intel.com (cherry picked from commit 9f9c117ac566cb567dd56cc5b7564c45653f7a2a) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe: Fix kerneldoc for xe_gt_tlb_inval_init_earlyShuicheng Lin
Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_tlb_inval.c:136 expecting prototype for xe_gt_tlb_inval_init(). Prototype was for xe_gt_tlb_inval_init_early() instead" v2: add () for the function. (Michal) Fixes: db16f9d90c1d9 ("drm/xe: Split TLB invalidation code in frontend and backend") Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260129233834.419977-7-shuicheng.lin@intel.com (cherry picked from commit 0651dbb9d6a72e99569576fbec4681fd8160d161) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe: Fix kerneldoc for xe_migrate_exec_queueShuicheng Lin
Correct the function name in the kerneldoc. It is for below warning: "Warning: drivers/gpu/drm/xe/xe_migrate.c:1262 expecting prototype for xe_get_migrate_exec_queue(). Prototype was for xe_migrate_exec_queue() instead" Fixes: 916ee4704a865 ("drm/xe/vf: Register CCS read/write contexts with Guc") Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260129233834.419977-6-shuicheng.lin@intel.com (cherry picked from commit 9fd8da717934f05125b9ba6782622c459a368dc0) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe/query: Fix topology query pointer advanceShuicheng Lin
The topology query helper advanced the user pointer by the size of the pointer, not the size of the structure. This can misalign the output blob and corrupt the following mask. Fix the increment to use sizeof(*topo). There is no issue currently, as sizeof(*topo) happens to be equal to sizeof(topo) on 64-bit systems (both evaluate to 8 bytes). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Link: https://patch.msgid.link/20260130043907.465128-2-shuicheng.lin@intel.com Signed-off-by: Matt Roper <matthew.d.roper@intel.com> (cherry picked from commit c2a6859138e7f73ad904be17dd7d1da6cc7f06b3) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI headerChaitanya Kumar Borah
The GuC scheduler ABI header contains a file-level comment that is not intended to document a kernel-doc symbol. Using kernel-doc comment syntax (/** */) triggers kernel-doc warnings. With "-Werror", this causes the build to fail. Convert the comment to a regular block comment. HDRTEST drivers/gpu/drm/xe/abi/guc_scheduler_abi.h Warning: drivers/gpu/drm/xe/abi/guc_scheduler_abi.h:11 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst * Generic defines required for registration with and submissions to the GuC 1 warnings as errors make[6]: *** [drivers/gpu/drm/xe/Makefile:377: drivers/gpu/drm/xe/abi/guc_scheduler_abi.hdrtest] Error 3 make[5]: *** [scripts/Makefile.build:544: drivers/gpu/drm/xe] Error 2 make[4]: *** [scripts/Makefile.build:544: drivers/gpu/drm] Error 2 make[3]: *** [scripts/Makefile.build:544: drivers/gpu] Error 2 make[2]: *** [scripts/Makefile.build:544: drivers] Error 2 make[1]: *** [/home/kbuild2/kernel/Makefile:2088: .] Error 2 make: *** [Makefile:248: __sub-make] Error 2 v2: - Add Fixes tag (Daniele) Fixes: b0c5cf4f5917 ("drm/gt/guc: extract scheduler-related defines from guc_fwif.h") Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com> Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Link: https://patch.msgid.link/20260130135210.2659200-1-chaitanya.kumar.borah@intel.com (cherry picked from commit f89dbe14a0c8854b7aaf960dd842c10698b3ff19) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05drm/xe/guc: Fix CFI violation in debugfs access.Daniele Ceraolo Spurio
xe_guc_print_info is void-returning, but the function pointer it is assigned to expects an int-returning function, leading to the following CFI error: [ 206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe] (target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a) Fix this by updating xe_guc_print_info to return an integer. Fixes: e15826bb3c2c ("drm/xe/guc: Refactor GuC debugfs initialization") Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com> Cc: Michal Wajdeczko <michal.wajdeczko@intel.com> Cc: George D Sworo <george.d.sworo@intel.com> Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com> Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com (cherry picked from commit dd8ea2f2ab71b98887fdc426b0651dbb1d1ea760) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-02-05PCI: dwc: Fix missing iATU setup when ECAM is enabledKrishna Chaitanya Chundru
When ECAM is enabled, the driver skipped calling dw_pcie_iatu_setup() before configuring ECAM iATU entries. This left IO and MEM outbound windows unprogrammed, resulting in broken IO transactions. Additionally, dw_pcie_config_ecam_iatu() was only called during host initialization, so ECAM-related iATU entries were not restored after suspend/resume, leading to failures in configuration space access To resolve these issues, move the ECAM iATU configuration to dw_pcie_iatu_setup(), and invoke dw_pcie_iatu_setup() when ECAM is enabled. Furthermore, add error checks in dw_pcie_prog_outbound_atu() and dw_pcie_prog_inbound_atu() such that an error is returned if the caller is trying to program an iATU that is outside the number of iATUs supported by the controller. Fixes: f6fd357f7afb ("PCI: dwc: Prepare the driver for enabling ECAM mechanism using iATU 'CFG Shift Feature'") Reported-by: Maciej W. Rozycki <macro@orcam.me.uk> Closes: https://lore.kernel.org/all/alpine.DEB.2.21.2511280256260.36486@angie.orcam.me.uk/ Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> Co-developed-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Niklas Cassel <cassel@kernel.org> [mani: used imperative tone] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Maciej W. Rozycki <macro@orcam.me.uk> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hans Zhang <zhanghuabing@ecosda.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Cc: stable+noautosel@kernel.org # depends on Clean up iATU index usage in dw_pcie_iatu_setup() Link: https://patch.msgid.link/20260127151038.1484881-8-cassel@kernel.org
2026-02-05PCI: dwc: Clean up iATU index usage in dw_pcie_iatu_setup()Niklas Cassel
The current iATU index usage in dw_pcie_iatu_setup() is a mess. For outbound address translation the index is incremented before usage. For inbound address translation the index is incremented after usage. Incrementing the index after usage make much more sense, and make the index usage consistent for both outbound and inbound address translation. Most likely, the overly complicated logic for the outbound address translation is because the iATU at index 0 is reserved for CFG IOs (dw_pcie_other_conf_map_bus()), however, we should be able to use the exact same logic for the indexing of the outbound and inbound iATUs. (Only the starting index should be different.) Create two new variables ob_iatu_index and ib_iatu_index, which makes it more clear from the name itself that it is a zeroes based index, and only increment the index if the iATU configuration call succeeded. Since we always check if there is an index available immediately before programming the iATU, we can remove the useless "ranges exceed outbound iATU size" warnings, as the code is already unreachable. For the same reason, we can also remove the useless breaks outside of the while loops. No functional changes intended. Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Maciej W. Rozycki <macro@orcam.me.uk> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hans Zhang <zhanghuabing@ecosda.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260127151038.1484881-7-cassel@kernel.org
2026-02-05PCI: dwc: Fix msg_atu_index assignmentNiklas Cassel
When dw_pcie_iatu_setup() configures outbound address translation for both type PCIE_ATU_TYPE_MEM and PCIE_ATU_TYPE_IO, the iATU index to use is incremented before calling dw_pcie_prog_outbound_atu(). However for msg_atu_index, the index is not incremented before use, causing the iATU index to be the same as the last configured iATU index, which means that it will incorrectly use the same iATU index that is already in use, breaking outbound address translation. In total there are three problems with this code: -It assigns msg_atu_index the same index that was used for the last outbound address translation window, rather than incrementing the index before assignment. -The index should only be incremented (and msg_atu_index assigned) if the use_atu_msg feature is actually requested/in use (pp->use_atu_msg is set). -If the use_atu_msg feature is requested/in use, and there are no outbound iATUs available, the code should return an error, as otherwise when this this feature is used, it will use an iATU index that is out of bounds. Fixes: e1a4ec1a9520 ("PCI: dwc: Add generic MSG TLP support for sending PME_Turn_Off when system suspend") Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Maciej W. Rozycki <macro@orcam.me.uk> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hans Zhang <zhanghuabing@ecosda.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260127151038.1484881-6-cassel@kernel.org
2026-02-05RDMA/siw: Fix potential NULL pointer dereference in header processingYunJe Shin
If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present. KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50 Fixes: 8b6a361b8c48 ("rdma/siw: receive path") Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr> Link: https://patch.msgid.link/20260204092546.489842-1-ioerts@kookmin.ac.kr Acked-by: Bernard Metzler <bernard.metzler@linux.dev> Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-02-05RDMA/umad: Reject negative data_len in ib_umad_writeYunJe Shin
ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, data_len can become negative and reach ib_create_send_mad(). This can make the padding calculation exceed the segment size and trigger an out-of-bounds memset in alloc_send_rmpp_list(). Add an explicit check to reject negative data_len before creating the send buffer. KASAN splat: [ 211.363464] BUG: KASAN: slab-out-of-bounds in ib_create_send_mad+0xa01/0x11b0 [ 211.364077] Write of size 220 at addr ffff88800c3fa1f8 by task spray_thread/102 [ 211.365867] ib_create_send_mad+0xa01/0x11b0 [ 211.365887] ib_umad_write+0x853/0x1c80 Fixes: 2be8e3ee8efd ("IB/umad: Add P_Key index support") Signed-off-by: YunJe Shin <ioerts@kookmin.ac.kr> Link: https://patch.msgid.link/20260203100628.1215408-1-ioerts@kookmin.ac.kr Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-02-05Merge branch 'acpi-bus'Rafael J. Wysocki
Merge ACPI support updates related to _OSC evaluation, the handling of "system resource" device objects, and ACPI-based device enumeration for 6.20-rc1/7.0-rc1: - Fix handling of _OSC errors in acpi_run_osc() to avoid failures on systems where _OSC error bits are set even though the _OSC return buffer contains acknowledged feature bits (Rafael Wysocki) - Clean up and rearrange \_SB._OSC handling for general platform features and USB4 features to avoid code duplication and unnecessary memory management overhead (Rafael Wysocki) - Make the ACPI core device enumeration code handle PNP0C01 and PNP0C02 ("system resource") device objects directly instead of letting the legacy PNP system driver handle them to avoid device enumeration issues on systems where PNP0C02 is present in the _CID list under ACPI device objects with a _HID matching a proper device driver in Linux (Rafael Wysocki) - Drop workarounds for the known device enumeration issues related to _CID lists containing PNP0C02 (Rafael Wysocki) - Drop outdated comment regarding removed function in the ACPI-based device enumeration code (Julia Lawall) - Make PRP0001 device matching work as expected for ACPI device objects using it as a _HID for board development and similar purposes (Kartik Rajput) - Use async schedule function in acpi_scan_clear_dep_fn() to avoid races with user space initialization on some systems (Yicong Yang) * acpi-bus: ACPI: scan: Use async schedule function in acpi_scan_clear_dep_fn() ACPI: bus: Align acpi_device_get_match_data() with driver match order ACPI: scan: Drop outdated comment regarding removed function ACPI: scan: Use resource_type() for resource type checking ACPI: bus: Fix typo under sizeof() in acpi_run_osc() ACPI: bus: Adjust acpi_osc_handshake() parameter list ACPI: bus: Rework the handling of \_SB._OSC USB4 features ACPI: bus: Adjust feature mask creation for \_SB._OSC ACPI: bus: Rework the handling of \_SB._OSC platform features ACPI: bus: Rename label and use ACPI_FREE() in acpi_run_osc() ACPI: bus: Split _OSC error processing out of acpi_run_osc() ACPI: bus: Split _OSC evaluation out of acpi_run_osc() ACPI: bus: Rework printing debug messages on _OSC errors ACPI: bus: Fix handling of _OSC errors in acpi_run_osc() ACPI: PNP: Drop acpi_nonpnp_device_ids[] platform/x86/intel/vbtn: Stop creating a platform device platform/x86/intel/hid: Stop creating a platform device ACPI: PNP: Drop PNP0C01 and PNP0C02 from acpi_pnp_device_ids[]
2026-02-05s390/tape: Consolidate tape config options and modulesJan Höppner
The tape device driver only supports 3490E devices on Virtual Tape Server (VTS). There is no point in keeping separated options and modules for different device types and general hardware support. Consolidate the tape config option into a single option, which enables the complete tape support with one singular module called 'tape_s390'. The corresponding module entry points are adapted and consolidate in tape_init() and tape_exit() respectively in tape_core.c The current module author and descriptions of the individual tape modules are outdated and haven't been changed for quite some time. Change it to a more generic description that is in line with the corresponding supported s390 architecture for the single tape module. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-05s390/cio: Fix device lifecycle handling in css_alloc_subchannel()Salah Triki
`css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki@gmail.com> Reviewed-by: Vineeth Vijayan <vneethv@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-05Merge branches 'acpi-pm', 'acpi-sysfs', 'acpi-pci' and 'acpi-resource'Rafael J. Wysocki
Merge ACPI power management updates, ACPI sysfs interface updates, an ACPI support update related to PCI, and an ACPI device resources management update for 6.20-rc1/7.0-rc1: - Rework ACPI PM notification setup for PCI root buses and modify the ACPI PM setup for devices to register wakeup source objects under physical (that is, PCI, platform, etc.) devices instead of doing that under their ACPI companions (Rafael Wysocki) - Adjust debug messages regarding postponed ACPI PM printed during system resume to be more accurate (Rafael Wysocki) - Remove dead code from lps0_device_attach() (Gergo Koteles) - Start to invoke Microsoft Function 9 (Turn On Display) of the Low- Power S0 Idle (LPS0) _DSM in the suspend-to-idle resume flow on systems with ACPI LPS0 support to address a functional issue on Lenovo Yoga Slim 7i Aura (15ILL9), where system fans and keyboard backlights fail to resume after suspend (Jakob Riemenschneider) - Add sysfs attribute cid for exposing _CID lists under ACPI device objects (Rafael Wysocki) - Replace sprintf() with sysfs_emit() in all of the core ACPI sysfs interface code (Sumeet Pawnikar) - Use acpi_get_local_u64_address() in the code implementing ACPI support for PCI to evaluate _ADR instead of evaluating that object directly (Andy Shevchenko) - Add JWIPC JVC9100 to irq1_level_low_skip_override[] to unbreak serial IRQs on that system (Ai Chao) * acpi-pm: ACPI: x86: s2idle: Invoke Microsoft _DSM Function 9 (Turn On Display) ACPI: PM: Adjust messages regarding postponed ACPI PM ACPI: x86: s2idle: Remove dead code in lps0_device_attach() ACPI: PM: Register wakeup sources under physical devices ACPI: PCI: PM: Rework root bus notification setup * acpi-sysfs: ACPI: sysfs: Replace sprintf() with sysfs_emit() ACPI: sysfs: Add device cid attribute for exposing _CID lists * acpi-pci: ACPI: PCI: simplify code with acpi_get_local_u64_address() * acpi-resource: ACPI: resource: Add JWIPC JVC9100 to irq1_level_low_skip_override[]
2026-02-05Merge branch 'acpi-irq'Rafael J. Wysocki
Merge ARM-related irq subsystem changes based on the recent ACPICA updates for 6.20-rc1/7.0-rc1: - Add support for GICv5 ACPI probing on ARM which is based on the GICv5 MADT structures and ARM IORT IWB node definitions recently added to ACPICA (Lorenzo Pieralisi) * acpi-irq: irqchip/gic-v5: Add ACPI IWB probing irqchip/gic-v5: Add ACPI ITS probing irqchip/gic-v5: Add ACPI IRS probing irqchip/gic-v5: Split IRS probing into OF and generic portions PCI/MSI: Make the pci_msi_map_rid_ctlr_node() interface firmware agnostic irqdomain: Add parent field to struct irqchip_fwid
2026-02-05Merge branch 'acpica'Rafael J. Wysocki
Merge ACPICA changes for 6.20-rc1/7.0-rc1: - Update the ACPICA code in the kernel to upstream version 20251212 which includes the following changes: * Add support for new ACPI table DTPR (Michal Camacho Romero) * Release objects with acpi_ut_delete_object_desc() (Zilin Guan) * Add UUIDs for Microsoft fan extensions and UUIDs associated with TPM 2.0 devices (Armin Wolf) * Fix NULL pointer dereference in acpi_ev_address_space_dispatch() (Alexey Simakov) * Add KEYP ACPI table definition (Dave Jiang) * Add support for the Microsoft display mux _OSI string (Armin Wolf) * Add definitions for the IOVT ACPI table (Xianglai Li) * Abort AML bytecode execution on AML_FATAL_OP (Armin Wolf) * Include all fields in subtable type1 for PPTT (Ben Horgan) * Add GICv5 MADT structures and Arm IORT IWB node definitions (Jose Marinho) * Update Parameter Block structure for RAS2 and add a new flag in Memory Affinity Structure for SRAT (Pawel Chmielewski) * Add _VDM (Voltage Domain) object (Pawel Chmielewski) * acpica: (26 commits) ACPICA: Refactor for TPR Base/Limit registers bitmasks ACPICA: Replace TPRn Base and Limit registers ACPICA: Logfile: Changes for version 20251212 ACPICA: Align comments in TPRn-related structures ACPICA: Cleanup comments and DTPR Table handle functions ACPICA: Verify DTPR and TPR Instance buffer pointers ACPICA: Fix Segmentation Fault error related to DTPR ACPICA: Create auxiliary ACPI_TPR_AUX_SR structure for iASL compiler ACPICA: ACPI 6.6: Add _VDM (Voltage Domain) object ACPICA: actbl3.h: ACPI 6.6: SRAT: New flag in Memory Affinity Structure ACPICA: actbl2.h: ACPI 6.6: RAS2: Update Parameter Block structure ACPICA: Add Arm IORT IWB node definitions ACPICA: Add GICv5 MADT structures ACPICA: Fix asltests using the Fatal() opcode ACPICA: ACPI 6.4: PPTT: include all fields in subtable type1 ACPICA: Abort AML bytecode execution when executing AML_FATAL_OP ACPICA: Define DTPR structure related info tables and data template ACPICA: Add DTPR table support for the ASL compiler ACPICA: iASL: Add definitions for the IOVT table ACPICA: Add support for the Microsoft display mux _OSI string ...
2026-02-05Merge branch 'move-can-skb-headroom-content-to-skb-extensions'Paolo Abeni
Oliver Hartkopp says: ==================== move CAN skb headroom content to skb extensions CAN bus related skbuffs (ETH_P_CAN/ETH_P_CANFD/ETH_P_CANXL) simply contain CAN frame structs for CAN CC/FD/XL of skb->len length at skb->data. Those CAN skbs do not have network/mac/transport headers nor other such references for encapsulated protocols like ethernet/IP protocols. To store data for CAN specific use-cases all CAN bus related skbuffs are created with a 16 byte private skb headroom (struct can_skb_priv). Using the skb headroom and accessing skb->head for this private data led to several problems in the past likely due to "The struct can_skb_priv business is highly unconventional for the networking stack." [1] This patch set aims to remove the unconventional skb headroom usage for CAN bus related skbuffs and use the common skb extensions instead. [1] https://lore.kernel.org/linux-can/20260104074222.29e660ac@kernel.org/ - v1: https://patch.msgid.link/20260125201601.5018-1-socketcan@hartkopp.net - v2: https://lore.kernel.org/linux-can/20260128-can-skb-ext-v2-0-fe64aa152c8a@pengutronix.de/ - v4: https://lore.kernel.org/netdev/20260128-can_skb_ext-v1-0-330f60fd5d7e@hartkopp.net/ - v5: https://patch.msgid.link/20260129-can_skb_ext-v5-0-21252fdc8900@hartkopp.net - v6: https://patch.msgid.link/20260130-can_skb_ext-v6-0-8fceafab7f26@hartkopp.net - v7: https://patch.msgid.link/20260131-can_skb_ext-v7-0-dd0f8f84a83d@hartkopp.net Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> ==================== Link: https://patch.msgid.link/20260201-can_skb_ext-v8-0-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: gw: use can_gw_hops instead of sk_buff::csum_startOliver Hartkopp
As CAN skbs don't use IP checksums the skb->csum_start variable was used to store the can-gw CAN frame time-to-live counter together with skb->ip_summed set to CHECKSUM_UNNECESSARY. Remove the 'hack' using the skb->csum_start variable and move the content to can_skb_ext::can_gw_hops of the CAN skb extensions. The module parameter 'max_hops' has been reduced to a single byte to fit can_skb_ext::can_gw_hops as the maximum value to be stored is 6. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-6-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: remove private CAN skb headroom infrastructureOliver Hartkopp
This patch removes struct can_skb_priv which was stored at skb->head and the can_skb_reserve() helper which was used to shift skb->head. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-5-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: move frame_len to CAN skb extensionsOliver Hartkopp
The can_skb_priv::frame_len variable is used to cache a previous calculated CAN frame length to be passed to BQL queueing disciplines. Move the can_skb_priv::frame_len content to can_skb_ext::can_framelen. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-4-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: move ifindex to CAN skb extensionsOliver Hartkopp
When routing CAN frames over different CAN interfaces the interface index skb->iif is overwritten with every single hop. To prevent sending a CAN frame back to its originating (first) incoming CAN interface another ifindex variable is needed, which was stored in can_skb_priv::ifindex. Move the can_skb_priv::ifindex content to can_skb_ext::can_iif. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-3-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: add CAN skb extension infrastructureOliver Hartkopp
To remove the private CAN bus skb headroom infrastructure 8 bytes need to be stored in the skb. The skb extensions are a common pattern and an easy and efficient way to hold private data travelling along with the skb. We only need the skb_ext_add() and skb_ext_find() functions to allocate and access CAN specific content as the skb helpers to copy/clone/free skbs automatically take care of skb extensions and their final removal. This patch introduces the complete CAN skb extensions infrastructure: - add struct can_skb_ext in new file include/net/can.h - add include/net/can.h in MAINTAINERS - add SKB_EXT_CAN to skbuff.c and skbuff.h - select SKB_EXTENSIONS in Kconfig when CONFIG_CAN is enabled - check for existing CAN skb extensions in can_rcv() in af_can.c - add CAN skb extensions allocation at every skb_alloc() location - duplicate the skb extensions if cloning outgoing skbs (framelen/gw_hops) - introduce can_skb_ext_add() and can_skb_ext_find() helpers The patch also corrects an indention issue in the original code from 2018: Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202602010426.PnGrYAk3-lkp@intel.com/ Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-2-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05can: use skb hash instead of private variable in headroomOliver Hartkopp
The can_skb_priv::skbcnt variable is used to identify CAN skbs in the RX path analogue to the skb->hash. As the skb hash is not filled in CAN skbs move the private skbcnt value to skb->hash and set skb->sw_hash accordingly. The skb->hash is a value used for RPS to identify skbs. Use it as intended. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net> Link: https://patch.msgid.link/20260201-can_skb_ext-v8-1-3635d790fe8b@hartkopp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05pmdomain: imx8mp-blk-ctrl: Keep usb phy power domain on for system wakeupXu Yang
USB system wakeup need its PHY on, so add the GENPD_FLAG_ACTIVE_WAKEUP flags to USB PHY genpd configuration. Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-05pmdomain: imx8mp-blk-ctrl: Keep gpc power domain on for system wakeupXu Yang
Current design will power off all dependent GPC power domains in imx8mp_blk_ctrl_suspend(), even though the user device has enabled wakeup capability. The result is that wakeup function never works for such device. An example will be USB wakeup on i.MX8MP. PHY device '382f0040.usb-phy' is attached to power domain 'hsioblk-usb-phy2' which is spawned by hsio block control. A virtual power domain device 'genpd:3:32f10000.blk-ctrl' is created to build connection with 'hsioblk-usb-phy2' and it depends on GPC power domain 'usb-otg2'. If device '382f0040.usb-phy' enable wakeup, only power domain 'hsioblk-usb-phy2' keeps on during system suspend, power domain 'usb-otg2' is off all the time. So the wakeup event can't happen. In order to further establish a connection between the power domains related to GPC and block control during system suspend, register a genpd power on/off notifier for the power_dev. This allows us to prevent the GPC power domain from being powered off, in case the block control power domain is kept on to serve system wakeup. Suggested-by: Ulf Hansson <ulf.hansson@linaro.org> Fixes: 556f5cf9568a ("soc: imx: add i.MX8MP HSIO blk-ctrl") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang <xu.yang_2@nxp.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-02-05MAINTAINERS: Remove myself from TC maintainersCong Wang
Recently TC maintainer Jamal intentionally a broke reasonable use case: https://lore.kernel.org/netdev/aG10rqwjX6elG1Gx@pop-os.localdomain/ Although I tried my best to help by: 1) Strongly objecting this breakage from the very beginning 2) Reverting it and offering a much better solution 3) Offering Jamal for video chat on 8 Jul 2025 and 26 Nov 2025 None of them worked. So it makes no sense for me to continue caring about this subsystem. Most importantly, intentionally breaking reasonable use cases is against my moral, I don't want to get ashamed. Thanks for the opportunity! Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Link: https://patch.msgid.link/20260130212021.46610-1-xiyou.wangcong@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05erofs: update compression algorithm statusGao Xiang
The following changes are proposed in the upcoming Linux 7.0: - Enable LZMA support by default, as it's already in use by Fedora 42/43 and some Android vendors for minimal filesystem sizes; - Promote DEFLATE and Zstandard out of EXPERIMENTAL status, given that they have been landed and well-tested for over a year and are already ready for general use. Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-02-05erofs: fix inline data read failure for ztailpacking pclustersGao Xiang
Compressed folios for ztailpacking pclusters must be valid before adding these pclusters to I/O chains. Otherwise, z_erofs_decompress_pcluster() may assume they are already valid and then trigger a NULL pointer dereference. It is somewhat hard to reproduce because the inline data is in the same block as the tail of the compressed indexes, which are usually read just before. However, it may still happen if a fatal signal arrives while read_mapping_folio() is running, as shown below: erofs: (device dm-1): z_erofs_pcluster_begin: failed to get inline data -4 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 ... pc : z_erofs_decompress_queue+0x4c8/0xa14 lr : z_erofs_decompress_queue+0x160/0xa14 sp : ffffffc08b3eb3a0 x29: ffffffc08b3eb570 x28: ffffffc08b3eb418 x27: 0000000000001000 x26: ffffff8086ebdbb8 x25: ffffff8086ebdbb8 x24: 0000000000000001 x23: 0000000000000008 x22: 00000000fffffffb x21: dead000000000700 x20: 00000000000015e7 x19: ffffff808babb400 x18: ffffffc089edc098 x17: 00000000c006287d x16: 00000000c006287d x15: 0000000000000004 x14: ffffff80ba8f8000 x13: 0000000000000004 x12: 00000006589a77c9 x11: 0000000000000015 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : ffffffffffffffe0 x3 : 0000000000000020 x2 : 0000000000000008 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: z_erofs_decompress_queue+0x4c8/0xa14 z_erofs_runqueue+0x908/0x97c z_erofs_read_folio+0x128/0x228 filemap_read_folio+0x68/0x128 filemap_get_pages+0x44c/0x8b4 filemap_read+0x12c/0x5b8 generic_file_read_iter+0x4c/0x15c do_iter_readv_writev+0x188/0x1e0 vfs_iter_read+0xac/0x1a4 backing_file_read_iter+0x170/0x34c ovl_read_iter+0xf0/0x140 vfs_read+0x28c/0x344 ksys_read+0x80/0xf0 __arm64_sys_read+0x24/0x34 invoke_syscall+0x60/0x114 el0_svc_common+0x88/0xe4 do_el0_svc+0x24/0x30 el0_svc+0x40/0xa8 el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1bc/0x1c0 Fix this by reading the inline data before allocating and adding the pclusters to the I/O chains. Fixes: cecf864d3d76 ("erofs: support inline data decompression") Reported-by: Zhiguo Niu <zhiguo.niu@unisoc.com> Reviewed-and-tested-by: Zhiguo Niu <zhiguo.niu@unisoc.com> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-02-05Merge branch kvm-arm64/misc-6.20 into kvmarm-master/nextMarc Zyngier
* kvm-arm64/misc-6.20: : . : Misc KVM/arm64 changes for 6.20 : : - Trivial FPSIMD cleanups : : - Calculate hyp VA size only once, avoiding potential mapping issues when : VA bits is smaller than expected : : - Silence sparse warning for the HYP stack base : : - Fix error checking when handling FFA_VERSION : : - Add missing trap configuration for DBGWCR15_EL1 : : - Don't try to deal with nested S2 when NV isn't enabled for a guest : : - Various spelling fixes : . KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported KVM: arm64: Fix various comments KVM: arm64: nv: Add trap config for DBGWCR<15>_EL1 KVM: arm64: Fix error checking for FFA_VERSION KVM: arm64: Fix missing <asm/stackpage/nvhe.h> include KVM: arm64: Calculate hyp VA size only once KVM: arm64: Remove ISB after writing FPEXC32_EL2 KVM: arm64: Shuffle KVM_HOST_DATA_FLAG_* indices KVM: arm64: Fix comment in fpsimd_lazy_switch_to_host() Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/resx into kvmarm-master/nextMarc Zyngier
* kvm-arm64/resx: : . : Add infrastructure to deal with the full gamut of RESx bits : for NV. As a result, it is now possible to have the expected : semantics for some bits such as SCTLR_EL2.SPAN. : . KVM: arm64: Add debugfs file dumping computed RESx values KVM: arm64: Add sanitisation to SCTLR_EL2 KVM: arm64: Remove all traces of HCR_EL2.MIOCNCE KVM: arm64: Remove all traces of FEAT_TME KVM: arm64: Simplify handling of full register invalid constraint KVM: arm64: Get rid of FIXED_VALUE altogether KVM: arm64: Simplify handling of HCR_EL2.E2H RESx KVM: arm64: Move RESx into individual register descriptors KVM: arm64: Add RES1_WHEN_E2Hx constraints as configuration flags KVM: arm64: Add REQUIRES_E2H1 constraint as configuration flags KVM: arm64: Simplify FIXED_VALUE handling KVM: arm64: Convert HCR_EL2.RW to AS_RES1 KVM: arm64: Correctly handle SCTLR_EL1 RES1 bits for unsupported features KVM: arm64: Allow RES1 bits to be inferred from configuration KVM: arm64: Inherit RESx bits from FGT register descriptors KVM: arm64: Extend unified RESx handling to runtime sanitisation KVM: arm64: Introduce data structure tracking both RES0 and RES1 bits KVM: arm64: Introduce standalone FGU computing primitive KVM: arm64: Remove duplicate configuration for SCTLR_EL1.{EE,E0E} arm64: Convert SCTLR_EL2 to sysreg infrastructure Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/debugfs-fixes into kvmarm-master/nextMarc Zyngier
* kvm-arm64/debugfs-fixes: : . : Cleanup of the debugfs iterator, which are way more complicated : than they ought to be, courtesy of Fuad Tabba. From the cover letter: : : "This series refactors the debugfs implementations for `idregs` and : `vgic-state` to use standard `seq_file` iterator patterns. : : The existing implementations relied on storing iterator state within : global VM structures (`kvm_arch` and `vgic_dist`). This approach : prevented concurrent reads of the debugfs files (returning -EBUSY) and : created improper dependencies between transient file operations and : long-lived VM state." : . KVM: arm64: Use standard seq_file iterator for vgic-debug debugfs KVM: arm64: Reimplement vgic-debug XArray iteration KVM: arm64: Use standard seq_file iterator for idregs debugfs Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/gicv5-prologue into kvmarm-master/nextMarc Zyngier
* kvm-arm64/gicv5-prologue: : . : Prologue to GICv5 support, courtesy of Sascha Bischoff. : : This is preliminary work that sets the scene for the full-blow : support. : . irqchip/gic-v5: Check if impl is virt capable KVM: arm64: gic: Set vgic_model before initing private IRQs arm64/sysreg: Drop ICH_HFGRTR_EL2.ICC_HAPR_EL1 and make RES1 KVM: arm64: gic-v3: Switch vGIC-v3 to use generated ICH_VMCR_EL2 Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/gicv3-tdir-fixes into kvmarm-master/nextMarc Zyngier
* kvm-arm64/gicv3-tdir-fixes: : . : Address two trapping-related issues when running legacy (i.e. GICv3) : guests on GICv5 hosts, courtesy of Sascha Bischoff. : . KVM: arm64: Correct test for ICH_HCR_EL2_TDIR cap for GICv5 hosts KVM: arm64: gic: Enable GICv3 CPUIF trapping on GICv5 hosts if required Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/fwb-for-all into kvmarm-master/nextMarc Zyngier
* kvm-arm64/fwb-for-all: : . : Allow pKVM's host stage-2 mappings to use the Force Write Back version : of the memory attributes by using the "pass-through' encoding. : : This avoids having two separate encodings for S2 on a given platform. : . KVM: arm64: Simplify PAGE_S2_MEMATTR KVM: arm64: Kill KVM_PGTABLE_S2_NOFWB KVM: arm64: Switch pKVM host S2 over to KVM_PGTABLE_S2_AS_S1 KVM: arm64: Add KVM_PGTABLE_S2_AS_S1 flag arm64: Add MT_S2{,_FWB}_AS_S1 encodings Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05Merge branch kvm-arm64/pkvm-no-mte into kvmarm-master/nextMarc Zyngier
* kvm-arm64/pkvm-no-mte: : . : pKVM updates preventing the host from using MTE-related system : sysrem registers when the feature is disabled from the kernel : command-line (arm64.nomte), courtesy of Fuad Taba. : : From the cover letter: : : "If MTE is supported by the hardware (and is enabled at EL3), it remains : available to lower exception levels by default. Disabling it in the host : kernel (e.g., via 'arm64.nomte') only stops the kernel from advertising : the feature; it does not physically disable MTE in the hardware. : : The ability to disable MTE in the host kernel is used by some systems, : such as Android, so that the physical memory otherwise used as tag : storage can be used for other things (i.e. treated just like the rest of : memory). In this scenario, a malicious host could still access tags in : pages donated to a guest using MTE instructions (e.g., STG and LDG), : bypassing the kernel's configuration." : . KVM: arm64: Use kvm_has_mte() in pKVM trap initialization KVM: arm64: Inject UNDEF when accessing MTE sysregs with MTE disabled KVM: arm64: Trap MTE access and discovery when MTE is disabled KVM: arm64: Remove dead code resetting HCR_EL2 for pKVM Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05ppp: enable TX scatter-gatherQingfang Deng
PPP channels using chan->direct_xmit prepend the PPP header to a skb and call dev_queue_xmit() directly. In this mode the skb does not need to be linear, but the PPP netdevice currently does not advertise scatter-gather features, causing unnecessary linearization and preventing GSO. Enable NETIF_F_SG and NETIF_F_FRAGLIST on PPP devices. In case a linear buffer is required (PPP compression, multilink, and channels without direct_xmit), call skb_linearize() explicitly. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://patch.msgid.link/20260129012902.941-1-dqfext@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-05KVM: arm64: Add debugfs file dumping computed RESx valuesMarc Zyngier
Computing RESx values is hard. Verifying that they are correct is harder. Add a debugfs file called "resx" that will dump all the RESx values for a given VM. I found it useful, maybe you will too. Co-developed-by: Fuad Tabba <tabba@google.com> Signed-off-by: Fuad Tabba <tabba@google.com> Tested-by: Fuad Tabba <tabba@google.com> Link: https://patch.msgid.link/20260202184329.2724080-21-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-05KVM: arm64: Add sanitisation to SCTLR_EL2Marc Zyngier
Sanitise SCTLR_EL2 the usual way. The most important aspect of this is that we benefit from SCTLR_EL2.SPAN being RES1 when HCR_EL2.E2H==0. Reviewed-by: Fuad Tabba <tabba@google.com> Tested-by: Fuad Tabba <tabba@google.com> Link: https://patch.msgid.link/20260202184329.2724080-20-maz@kernel.org Signed-off-by: Marc Zyngier <maz@kernel.org>
generated by cgit v1.3 (git 2.53.0) at 2026-10-19 20:40:39 +0000